Get Processes By IOC - BlinkOps Documentation

Search for processes associated with a custom IOC. The following permission is required to run this action:

IOC Management: Read and Write.
IOCs (Indicators of Compromise): Read.

Note: An error with 404 response code may occur if no devices are found for the indicator, or if the host has aged out.

External DocumentationTo learn more, visit the CrowdStrike documentation.

Basic Parameters

Parameter	Description
Device ID	Specify a device ID to return only processes from that device.
Indicator Type	The type of the indicator.
Return All Pages	Automatically fetch all resources, page by page.
Value	The string representation of the indicator, can be obtained by using the `Get Indicator Details`.

Advanced Parameters

Parameter	Description
Limit	Number of processes to return in the response.
Offset	The first process to return, where 0 is the latest offset. Use with the limit parameter to manage pagination of results.

Example Output

{
	"meta": {
		"query_time": 0.10,
		"pagination": {
			"offset": "1364242733:397800512",
			"limit": 2,
			"next_page": "/indicators/queries/processes/v1?type=domain&value=example.com&device_id=2dd7xxxxxxxxfb3c2&offset=1364242733:397800512&limit=1"
		},
		"trace_id": "a4d3ba63-28e4-473e-9b6f-61dd0b8be4fe",
		"entity": "https://falconapi.crowdstrike.com/processes/entities/processes/v1{?ids*}"
	},
	"resources": [
		"pid:2dd7xxxxxxxxb3c2:298xxx772",
		"pid:2dd7xxxxxxxxb3c2:922xxx411"
	],
	"errors": []
}

Workflow Library Example

Get Processes by Ioc with Crowdstrike and Send Results Via Email

Preview this Workflow on desktop