> ## Documentation Index
> Fetch the complete documentation index at: https://docs.blinkops.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Find Malicious IPAddresses

Find IP addresses known to be involved in attack execution or outbound callbacks from malware.

The following permissions are required to run this action:

* `Indicators (Falcon Indicator Graph)`: **Read**.

<Note>
  External Documentation

  To learn more, visit the [CrowdStrike documentation](https://falcon.us-2.crowdstrike.com/documentation/page/k978e55e/falcon-indicator-graph-apis#of43eac6).
</Note>

## Basic Parameters

<div className="integrations-table">
  | Parameter  | Description                                                                                                                                                                                                                                                         |
  | ---------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
  | Filter     | Filter the results by a FQL query.<br /><br />For a complete list of filterable properties and syntax guidance, refer to the [CrowdStrike API documentation](https://falcon.us-2.crowdstrike.com/documentation/page/k978e55e/falcon-indicator-graph-apis#idf3b51b). |
  | Sort By    | The field to sort the results by.                                                                                                                                                                                                                                   |
  | Sort Order | The direction in which to sort the results.                                                                                                                                                                                                                         |
</div>

## Advanced Parameters

<div className="integrations-table">
  | Parameter | Description                                                  |
  | --------- | ------------------------------------------------------------ |
  | Limit     | The number of results to return. Valid range is `0` - `100`. |
</div>

## Example Output

```json theme={"dark"}
{
	"meta": {
		"query_time": 1.454724531,
		"pagination": {
			"limit": 10,
			"offset": "pSFFO1Ctnodv...",
			"next_page": "limit=10&offset=pSFFO1CtnodvTA8G..."
		},
		"powered_by": "fig-api",
		"trace_id": "94efc630-4f99-4345-8d43-d87a6cda41f5",
		"total_hits": 10
	},
	"resources": [
		{
			"ID": "IPv4:8c2e3ba5972e6137c8554f4320e14fa410dd9c61b807e030fc04e0834e3ba3eb",
			"Type": "IPv4",
			"PublishDate": "2025-01-23T19:24:54Z",
			"LastUpdated": "2025-01-23T19:25:06Z",
			"MaliciousConfidence": "High",
			"MaliciousConfidenceValidatedTime": "2025-01-23T19:24:54Z",
			"ThreatTypes": [
				"Modular",
				"Commodity",
				"OpenSource",
				"Criminal",
				"RAT"
			],
			"Threats": [
				{
					"FamilyName": "AsyncRAT"
				}
			],
			"Sectors": [
				{
					"Name": "Government",
					"Definition": "An entity involved in the governing body of a nation, state, or community."
				}
			],
			"IPv4Details": {
				"IPv4": "192.0.2.1",
				"ASN": [
					64496
				],
				"IPProperties": [
					"proxy"
				],
				"ISP": "Example ISP"
			}
		}
	]
}
```

## Workflow Library Example

[Find Malicious Ipaddresses with Crowdstrike and Send Results Via Email](https://library.blinkops.com/workflows/find-malicious-ipaddresses-with-crowdstrike-and-send-results-via-email)

<div className="iframe-wrapper">
  <div className="iframe-media">
    <img src="https://mintcdn.com/blinkops-2/ojHYuDeYX5FWuN8a/img/Icons/play-box.svg?fit=max&auto=format&n=ojHYuDeYX5FWuN8a&q=85&s=b8af968e71438a9499c3223c9bd29fb2" alt="Workflow Library" width="16" height="16" data-path="img/Icons/play-box.svg" />

    Preview this Workflow on desktop
  </div>

  <iframe className="iframe" src="https://library.blinkops.com/workflows/find-malicious-ipaddresses-with-crowdstrike-and-send-results-via-email/canvas" />
</div>