Get Devices Count For IOC - BlinkOps Documentation

Get the number of hosts in your customer account that have observed a given customer IOC. Note: This response has a limit of 2,000 hosts. If there are more than 2,000 hosts, limit_exceeded is returned as true in the response. You can use the Search Across Devices action to page through results for hosts counts over 2,000. The following permission is required to run this action:

IOC Management: Read and Write.
IOCs (Indicators of Compromise): Read.

Note: An error with 404 response code may occur if no devices are found for the indicator, or if the host has aged out.

External DocumentationTo learn more, visit the CrowdStrike documentation.

Parameters

Parameter	Description
Indicator Type	The type of the indicator.
Value	The string representation of the indicator, can be obtained by using the `Get Indicator Details`.

Example Output

{
	"meta": {
		"query_time": 0.041169611,
		"trace_id": "7e2c0465-81ce-41b0-b87f-1a2ffb96f65c"
	},
	"resources": [
		{
			"id": "domain:example.com",
			"type": "domain",
			"value": "example.com",
			"device_count": 13
		}
	],
	"errors": []
}

Workflow Library Example

Get Devices Count for Ioc with Crowdstrike and Send Results Via Email

Preview this Workflow on desktop

​Parameters

​Example Output

​Workflow Library Example

Parameters

Example Output

Workflow Library Example