List Aggregated Alerts - BlinkOps Documentation

Retrieve aggregated alert data based on specified queries.

External DocumentationTo learn more, visit the CrowdStrike documentation.

Parameters

Parameter Description

Aggregate Queries

Parameter	Description
Aggregate Queries	A list of queries by which to aggregate the retrieved alerts. For example: [ { “date_ranges”: [ { “from”: “string”, “to”: “string” } ], “exclude”: “string”, “field”: “string”, “filter”: “string”, “from”: 0, “include”: “string”, “interval”: “string”, “max_doc_count”: 0, “min_doc_count”: 0, “missing”: “string”, “name”: “string”, “q”: “string”, “ranges”: [ { “From”: 0, “To”: 0 } ], “size”: 0, “sort”: “string”, “sub_aggregates”: [ null ], “time_zone”: “string”, “type”: “string” } ]
Include Hidden	Select to allow hidden alerts to be retrieved.

A list of queries by which to aggregate the retrieved alerts.

For example:

[
  {
    “date_ranges”: [
      {
        “from”: “string”,
        “to”: “string”
      }
    ],
    “exclude”: “string”,
    “field”: “string”,
    “filter”: “string”,
    “from”: 0,
    “include”: “string”,
    “interval”: “string”,
    “max_doc_count”: 0,
    “min_doc_count”: 0,
    “missing”: “string”,
    “name”: “string”,
    “q”: “string”,
    “ranges”: [
      {
        “From”: 0,
        “To”: 0
      }
    ],
    “size”: 0,
    “sort”: “string”,
    “sub_aggregates”: [
      null
    ],
    “time_zone”: “string”,
    “type”: “string”
  }
]

Include Hidden Select to allow hidden alerts to be retrieved.

Example Output

{
	"errors": [
		{
			"code": 0,
			"id": "string",
			"message": "string"
		}
	],
	"meta": {
		"pagination": {
			"limit": 0,
			"offset": 0,
			"total": 0
		},
		"powered_by": "string",
		"query_time": 0,
		"trace_id": "string",
		"writes": {
			"resources_affected": 0
		}
	},
	"resources": [
		{
			"buckets": [
				{
					"count": 0,
					"from": 0,
					"key_as_string": "string",
					"string_from": "string",
					"string_to": "string",
					"sub_aggregates": [
						null
					],
					"to": 0,
					"value": 0,
					"value_as_string": "string"
				}
			],
			"name": "string",
			"sum_other_doc_count": 0
		}
	]
}

Workflow Library Example

List Aggregated Alerts with Crowdstrike and Send Results Via Email

Preview this Workflow on desktop

List Adversary IDs List Alerts

⌘I

​Parameters

​Example Output

​Workflow Library Example

Parameters

Example Output

Workflow Library Example