List Aggregated Alerts - BlinkOps Documentation

Parameters
Example Output
Workflow Library Example

Retrieve aggregated alert data based on specified queries.

External DocumentationTo learn more, visit the CrowdStrike documentation.

Parameters

Parameter Description

Aggregate Queries

Parameter	Description
Aggregate Queries	A list of queries by which to aggregate the retrieved alerts. For example: [ { “date_ranges”: [ { “from”: “string”, “to”: “string” } ], “exclude”: “string”, “field”: “string”, “filter”: “string”, “from”: 0, “include”: “string”, “interval”: “string”, “max_doc_count”: 0, “min_doc_count”: 0, “missing”: “string”, “name”: “string”, “q”: “string”, “ranges”: [ { “From”: 0, “To”: 0 } ], “size”: 0, “sort”: “string”, “sub_aggregates”: [ null ], “time_zone”: “string”, “type”: “string” } ]
Include Hidden	Select to allow hidden alerts to be retrieved.

A list of queries by which to aggregate the retrieved alerts.

For example:

[
  {
    “date_ranges”: [
      {
        “from”: “string”,
        “to”: “string”
      }
    ],
    “exclude”: “string”,
    “field”: “string”,
    “filter”: “string”,
    “from”: 0,
    “include”: “string”,
    “interval”: “string”,
    “max_doc_count”: 0,
    “min_doc_count”: 0,
    “missing”: “string”,
    “name”: “string”,
    “q”: “string”,
    “ranges”: [
      {
        “From”: 0,
        “To”: 0
      }
    ],
    “size”: 0,
    “sort”: “string”,
    “sub_aggregates”: [
      null
    ],
    “time_zone”: “string”,
    “type”: “string”
  }
]

Include Hidden Select to allow hidden alerts to be retrieved.

Example Output

{
	"errors": [
		{
			"code": 0,
			"id": "string",
			"message": "string"
		}
	],
	"meta": {
		"pagination": {
			"limit": 0,
			"offset": 0,
			"total": 0
		},
		"powered_by": "string",
		"query_time": 0,
		"trace_id": "string",
		"writes": {
			"resources_affected": 0
		}
	},
	"resources": [
		{
			"buckets": [
				{
					"count": 0,
					"from": 0,
					"key_as_string": "string",
					"string_from": "string",
					"string_to": "string",
					"sub_aggregates": [
						null
					],
					"to": 0,
					"value": 0,
					"value_as_string": "string"
				}
			],
			"name": "string",
			"sum_other_doc_count": 0
		}
	]
}