Search Query By ID action.
Once the job is started, the search runs in the background, and the results will be returned once the job is completed.
External DocumentationTo learn more, visit the CrowdStrike documentation.
Basic Parameters
| Parameter | Description |
|---|---|
| Around | Find events that occurred around a specific event by using the around argument with its specified parameters. |
| Around Event ID | The ID of the event to search around. |
| Around Time Stamp | The timestamp to use as the reference point. |
| End | The date and time to use as the ending point of the search results. You can use End with a Start to define a specific time range. If Start is provided, it must be less than or equal to the End.You can also use the Time Zone Off Set Minutes to retrieve results relative to your timezone.For information about formatting options when specifying a time see Search API Time Specification |
| Number of Events After Event | Number of events to show after the eventId. |
| Number of Events Before Event | Number of events to show before the eventId. |
| Query | The CQL query to use for the search. For more information, see Query Language Syntax. The Query parameter accepts queries written in CrowdStrike Query Language.Note: Double quotes “ and backslashes \ must be escaped with a backslash \ to ensure they are properly interpreted.For example: Escaped double quote: \"Escaped backslash: \\ |
| Repository | The repository to run the query against. For info about repository options, see Repositories. |
| Start | The date and time to use as the starting point of the search results. You can use Start with an End to define a specific time range. If End is provided, it must be greater than or equal to the Start.You can also use the Time Zone Offset Minutes to retrieve results relative to your timezone.For information about formatting options when specifying a time see Search API Time Specification |
Advanced Parameters
| Parameter | Description |
|---|---|
| Ingest End | The date and time to use as the ending point of the search results, based on an event’s recorded Ingest Time Stamp field. You can use Ingest End with Ingest Start to define a specific time range. If Ingest Start is provided, it must be less than or equal to the Ingest End.You can also use the Time Zone Off Set Minutes to retrieve results relative to your timezone.For information about formatting options when specifying a time see Search API Time Specification |
| Ingest Start | The date and time to use as the starting point of the search results, based on an event’s recorded Ingest Time Stamp field.You can use Ingest Start with Ingest End to define a specific time range. If Ingest End is provided, it must be greater than or equal to the Ingest Start.You can also use the Time Zone Off Set Minutes to retrieve results relative to your timezone.For information about formatting options when specifying a time see Search API Time Specification |
| Time Zone Offset Minutes | A positive or negative number representing how many minutes a given time zone is ahead or behind Coordinated Universal Time (UTC). You can use Time Zone Offset Minutes with timestamp parameters like start and end to retrieve search results relative to your local time zone.The time zone offset must be provided in minutes. For example, if your time zone is UTC+1:00, you would pass a value of 60. |
| Use Ingest Time | When set to true, the event’s ingestStart and ingestEnd times are used as the basis for the query timespan rather than the start and end timestamps.If both ingestStart/ingestEnd and start/end are provided and Use Ingest Time is false, the start/end times are used. |
Example Output
{
"cancelled": false,
"done": true,
"events": [
{
"Vendor.modulesRun[0]": "<string>",
"Vendor.messageParts[0].oContentType": "<string>",
"Vendor.messageParts[1].disposition": "<string>",
"Vendor.threatsInfoMap[0].threatStatus": "<string>",
"Vendor.modulesRun[5]": "<string>",
"Vendor.messageParts[0].filename": "<string>",
"Vendor.messageParts[0].sha256": "<string>",
"email.attachments.file.hash.md5": "<string>",
"Vendor.modulesRun[6]": "<string>",
"email.attachments.file.hash.sha256": "<string>",
"@timestamp": 3104353851384,
"#Cps.version": "<string>",
"@ingesttimestamp": "<string>",
"Vendor.messageParts[1].contentType": "<string>",
"Vendor.spamScore": "<string>",
"Vendor.QID": "<string>",
"Vendor.cluster": "<string>",
"#type": "<string>",
"email.subject": "<string>",
"event.type[0]": "<string>",
"Vendor.modulesRun[1]": "<string>",
"Vendor.threatsInfoMap[0].threat": "<string>",
"Vendor.completelyRewritten": "<string>",
"Vendor.messageID": "<string>",
"Vendor.phishScore": "<string>",
"event.id": "<string>",
"Vendor.eventType": "<string>",
"Vendor.messageParts[0].disposition": "<string>",
"#repo": "<string>",
"#Vendor": "<string>",
"Vendor.modulesRun[2]": "<string>",
"threat.indicator.name": "<string>",
"#repo.cid": "<string>",
"Vendor.threatsInfoMap[0].threatID": "<string>",
"#event.kind": "<string>",
"Vendor.threatsInfoMap[0].threatUrl": "<string>",
"Vendor.impostorScore": "<string>",
"Vendor.toAddresses[0]": "<string>",
"@sourcetype": "<string>",
"Vendor.modulesRun[3]": "<string>",
"Vendor.policyRoutes[1]": "<string>",
"event.category[0]": "<string>",
"#ecs.version": "<string>",
"Vendor.messageParts[1].oContentType": "<string>",
"Vendor.messageParts[1].sha256": "<string>",
"Vendor.threatsInfoMap[0].threatTime": "2018-07-25T05:26:29.243Z",
"email.sender.address": "<string>",
"@timezone": "<string>",
"email.to.address[0]": "<string>",
"#event.module": "<string>",
"Vendor.messageParts[0].md5": "<string>",
"Vendor.quarantineFolder": "<string>",
"Vendor.messageParts[1].md5": "<string>",
"source.ip": "<string>",
"Vendor.messageParts[0].contentType": "<string>",
"Vendor.messageParts[1].filename": "<string>",
"email.attachments.file.mime_type": "<string>",
"@source": "<string>",
"email.from.address[0]": "<string>",
"file.name": "<string>",
"Vendor.modulesRun[4]": "<string>",
"Parser.version": "<string>",
"@timestamp.nanos": "<string>",
"Vendor.fromAddress[0]": "<string>",
"Vendor.messageSize": "<string>",
"Vendor.threatsInfoMap[0].threatType": "<string>",
"Vendor.policyRoutes[0]": "<string>",
"event.action": "<string>",
"@dataConnectionID": "<string>",
"Vendor.malwareScore": "<string>",
"@rawstring": "<string>",
"Vendor.modulesRun[7]": "<string>",
"event.reason": "<string>",
"Vendor.threatsInfoMap[0].detectionType": "<string>",
"Vendor.recipient[0]": "<string>",
"Vendor.GUID": "<string>",
"@id": "<string>"
},
{
"Vendor.modulesRun[0]": "<string>",
"Vendor.messageParts[0].oContentType": "<string>",
"Vendor.messageParts[1].disposition": "<string>",
"Vendor.threatsInfoMap[0].threatStatus": "<string>",
"Vendor.modulesRun[5]": "<string>",
"Vendor.messageParts[0].filename": "<string>",
"Vendor.messageParts[0].sha256": "<string>",
"email.attachments.file.hash.md5": "<string>",
"Vendor.modulesRun[6]": "<string>",
"email.attachments.file.hash.sha256": "<string>",
"@timestamp": 858547536611,
"#Cps.version": "<string>",
"@ingesttimestamp": "1745010203640",
"Vendor.messageParts[1].contentType": "<string>",
"Vendor.spamScore": "<string>",
"Vendor.QID": "<string>",
"Vendor.cluster": "<string>",
"#type": "<string>",
"email.subject": "<string>",
"event.type[0]": "<string>",
"Vendor.modulesRun[1]": "<string>",
"Vendor.threatsInfoMap[0].threat": "<string>",
"Vendor.completelyRewritten": "<string>",
"Vendor.messageID": "<string>",
"Vendor.phishScore": "<string>",
"event.id": "<string>",
"Vendor.eventType": "<string>",
"Vendor.messageParts[0].disposition": "<string>",
"#repo": "<string>",
"#Vendor": "<string>",
"Vendor.modulesRun[2]": "<string>",
"threat.indicator.name": "<string>",
"#repo.cid": "<string>",
"Vendor.threatsInfoMap[0].threatID": "<string>",
"#event.kind": "<string>",
"Vendor.threatsInfoMap[0].threatUrl": "<string>",
"Vendor.impostorScore": "<string>",
"Vendor.toAddresses[0]": "<string>",
"@sourcetype": "<string>",
"Vendor.modulesRun[3]": "<string>",
"Vendor.policyRoutes[1]": "<string>",
"event.category[0]": "<string>",
"#ecs.version": "<string>",
"Vendor.messageParts[1].oContentType": "<string>",
"Vendor.messageParts[1].sha256": "<string>",
"Vendor.threatsInfoMap[0].threatTime": "2022-12-09T07:33:07",
"email.sender.address": "<string>",
"@timezone": "<string>",
"email.to.address[0]": "<string>",
"#event.module": "<string>",
"Vendor.messageParts[0].md5": "<string>",
"Vendor.quarantineFolder": "<string>",
"Vendor.messageParts[1].md5": "<string>",
"source.ip": "<string>",
"Vendor.messageParts[0].contentType": "<string>",
"Vendor.messageParts[1].filename": "<string>",
"email.attachments.file.mime_type": "<string>",
"@source": "<string>",
"email.from.address[0]": "<string>",
"file.name": "<string>",
"Vendor.modulesRun[4]": "<string>",
"Parser.version": "<string>",
"@timestamp.nanos": "<string>",
"Vendor.fromAddress[0]": "<string>",
"Vendor.messageSize": "<string>",
"Vendor.threatsInfoMap[0].threatType": "<string>",
"Vendor.policyRoutes[0]": "<string>",
"event.action": "<string>",
"@dataConnectionID": "<string>",
"Vendor.malwareScore": "<string>",
"@rawstring": "<string>",
"Vendor.modulesRun[7]": "<string>",
"event.reason": "<string>",
"Vendor.threatsInfoMap[0].detectionType": "<string>",
"Vendor.recipient[0]": "<string>",
"Vendor.GUID": "<string>",
"@id": "<string>"
}
],
"fieldStats": [],
"filesUsed": [],
"metaData": {
"costs": {
"liveCost": 2,
"liveCostRate": 1,
"staticCost": 245,
"staticCostRate": 2
},
"digestFlow": {
"ingestTimeKnownGood": 278569914634,
"maxIngestLatency": 21820,
"minIngestTimeIncluded": 2993615274157
},
"eventCount": 20,
"extraData": {
"hasMoreEvents": "<string>"
},
"filterQuery": {
"allowEventSkipping": false,
"computeFieldStats": false,
"end": 967630219902,
"includeDeletedEvents": false,
"ingestEnd": 16081319460800930941,
"ingestStart": 1,
"isAlertQuery": false,
"isInteractive": false,
"isLive": false,
"isRepeatingSubquery": false,
"languageVersion": "<string>",
"noResultUntilDone": false,
"queryString": "<string>",
"showQueryEventDistribution": false,
"start": 1922788899957,
"useIngestTime": false
},
"isAggregate": false,
"pollAfter": 1574,
"processedBytes": 972414891273,
"processedEvents": 563919,
"queryEnd": 1721278336224,
"querySpent": {
"day": {
"liveCost": 1,
"queryCount": 1,
"staticCost": 530
},
"hour": {
"liveCost": 0,
"queryCount": 1,
"staticCost": 1407
},
"oneMinute": {
"liveCost": 0,
"queryCount": 2,
"staticCost": 1017
},
"tenMinutes": {
"liveCost": 2,
"queryCount": 0,
"staticCost": 182
}
},
"queryStart": 2334108608729,
"queuedMillis": 0,
"quotaTotalSpent": {
"day": {
"liveCost": 1,
"queryCount": 793,
"staticCost": 1887
},
"hour": {
"liveCost": 1,
"queryCount": 14,
"staticCost": 331
},
"oneMinute": {
"liveCost": 0,
"queryCount": 4,
"staticCost": 19
},
"tenMinutes": {
"liveCost": 0,
"queryCount": 9,
"staticCost": 67
}
},
"responderVHost": 37,
"resultBufferSize": 19,
"timeMillis": 405,
"totalWork": 15873,
"warnings": [],
"workDone": 11172
},
"warnings": []
}
Workflow Library Example
Next Gen Siem Advanced Search with Crowdstrike and Send Results Via Email