External DocumentationTo learn more, visit the CrowdStrike documentation.
Basic Parameters
| Parameter | Description |
|---|---|
| Filter | Filter the results based on FQL queries guidelines. Usage examples: - Return only Endpoint Protection alert IDs: product:'epp'- Return only Identity Protection alert IDs: product:'idp'- Return only Falcon for Mobile alert IDs: product:'mobile'- Return only Falcon XDR IDs: product:'xdr'- Return only OverWatch alert IDs: product:'overwatch'- Return only Cloud Workload Protection alert IDs: product:'cwpp' |
| Include Hidden | Determines whether hidden alerts will be included in the results. |
| Query | Search all alert metadata for the provided string. |
| Return All Pages | Automatically fetch all resources, page by page. |
Advanced Parameters
| Parameter | Description |
|---|---|
| Limit | The maximum number of records to return. [1-5000]. Default value: 100. |
| Offset | The zero-based position of the first record to return. Default value: 0. |
| Sort | Sort the results based on a field. The format of the sort criteria is: field|direction. Direction can be either asc (ascending) or desc (descending) order.For example: status|asc. |
Example Output
{
"data": {
"id": "<string>",
"type": "<string>",
"links": {
"self": "<string>",
"item": "<string>"
},
"attributes": {
"results": {
"ExampleOne": {
"method": "<string>",
"engine_name": "<string>",
"category": "<string>",
"result": "<string>"
},
"ExampleTwo": {
"method": "<string>",
"engine_name": "<string>",
"category": "<string>",
"result": "<string>"
}
},
"status": "<string>",
"stats": {
"malicious": 7,
"suspicious": 2,
"undetected": 54,
"harmless": 110,
"timeout": 0
},
"date": 70115994
}
},
"meta": {
"url_info": {
"id": "<string>",
"url": "<string>"
}
}
}
Workflow Library Example
List Alerts with Crowdstrike and Send Results Via Email