List Indicators - BlinkOps Documentation

Find the IDs of your indicator entities. The IDs can then be used to retrieve your indicator entity with the action Get Indicator Details, which includes the actual value of the indicator. The following permission is required to run this action:

IOC Management: Read.

External DocumentationTo learn more, visit the CrowdStrike documentation.

Basic Parameters

Parameter	Description
Filter	Narrow the result set by specifying FQL filters, or omit FQL filters to get a list of all IOC IDs in your environment. For more info on FQL filters, see our Falcon Query Language reference. Valid filter fields that can be used to narrow the result set: - type - value - action - mobile_action - severity - platforms - tags - expiration - expired - applied_globally - host_groups - created_on - created_by - modified_on - modified_by - source
Return All Pages	Automatically fetch all resources, page by page.

Advanced Parameters

Parameter	Description
After	A pagination token used with the `limit` parameter to manage pagination of results. On your first request, don’t provide an ‘after’ token. On subsequent requests, provide the ‘after’ token from the previous response to continue from that place in the results. To access more than 10k indicators, use the ‘after’ parameter instead of ‘offset’.
Limit	The maximum records to return.
Offset	The offset to start retrieving records from. Offset and After params are mutually exclusive. If none provided then scrolling will be used by default. To access more than 10k iocs, use the ‘after’ parameter instead of ‘offset’.
Sort	The sort expression that should be used to sort the results.

Example Output

{
	"meta": {
		"query_time": 1,
		"pagination": {
			"limit": 31,
			"total": 1,
			"offset": 0
		},
		"powered_by": "<string>",
		"trace_id": "<string>"
	},
	"errors": null,
	"resources": []
}

Workflow Library Example

List Indicators with Crowdstrike and Send Results Via Email

Preview this Workflow on desktop