Get Indicator Details
, which includes the actual value of the indicator.
The following permission is required to run this action:
IOC Management
: Read and Write.Parameter | Description |
---|---|
Filter | Narrow the result set by specifying FQL filters, or omit FQL filters to get a list of all IOC IDs in your environment. For more info on FQL filters, see our Falcon Query Language reference. Valid filter fields that can be used to narrow the result set: - type - value - action - mobile_action - severity - platforms - tags - expiration - expired - applied_globally - host_groups - created_on - created_by - modified_on - modified_by - source |
Return All Pages | Automatically fetch all resources, page by page. |
Parameter | Description |
---|---|
After | A pagination token used with the limit parameter to manage pagination of results. On your first request, don’t provide an ‘after’ token. On subsequent requests, provide the ‘after’ token from the previous response to continue from that place in the results. To access more than 10k indicators, use the ‘after’ parameter instead of ‘offset’. |
Limit | The maximum records to return. |
Offset | The offset to start retrieving records from. Offset and After params are mutually exclusive. If none provided then scrolling will be used by default. To access more than 10k iocs, use the ‘after’ parameter instead of ‘offset’. |
Sort | The sort expression that should be used to sort the results. |