> ## Documentation Index
> Fetch the complete documentation index at: https://docs.blinkops.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Search Indicators

Search for and retrieve indicators based on custom criteria.

The following permissions are required to run this action:

* `Indicators (Falcon Indicator Graph)`: **Read**.

<Note>
  External Documentation

  To learn more, visit the [CrowdStrike documentation](https://falcon.us-2.crowdstrike.com/documentation/page/k978e55e/falcon-indicator-graph-apis#ndac9ad5).
</Note>

## Basic Parameters

<div className="integrations-table">
  | Parameter        | Description                                                                                                                                                                                                                                                         |
  | ---------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
  | Filter           | Filter the results by a FQL query.<br /><br />For a complete list of filterable properties and syntax guidance, refer to the [CrowdStrike API documentation](https://falcon.us-2.crowdstrike.com/documentation/page/k978e55e/falcon-indicator-graph-apis#k833b132). |
  | Return All Pages | Automatically fetch all resources, page by page.                                                                                                                                                                                                                    |
  | Sort By          | The field to sort results by.                                                                                                                                                                                                                                       |
  | Sort Order       | The direction in which to sort the results.                                                                                                                                                                                                                         |
</div>

## Advanced Parameters

<div className="integrations-table">
  | Parameter | Description                                  |
  | --------- | -------------------------------------------- |
  | Limit     | The number of results to return.             |
  | Offset    | The offset to start retrieving records from. |
</div>

## Example Output

```json theme={"dark"}
{
	"meta": {
		"query_time": 1.454724531,
		"pagination": {
			"limit": 10,
			"offset": "pSFFO1Ctnodv...",
			"next_page": "limit=10&offset=pSFFO1CtnodvTA8G..."
		},
		"powered_by": "fig-api",
		"trace_id": "94efc630-4f99-4345-8d43-d87a6cda41f5",
		"total_hits": 10
	},
	"resources": [
		{
			"ID": "Domain:8c2e3ba5972e6137c8554f4320e14fa410dd9c61b807e030fc04e0834e3ba3eb",
			"Type": "Domain",
			"PublishDate": "2025-01-23T19:24:54Z",
			"LastUpdated": "2025-01-23T19:25:06Z",
			"MaliciousConfidence": "High",
			"MaliciousConfidenceValidatedTime": "2025-01-23T19:24:54Z",
			"ThreatTypes": [
				"Modular",
				"Commodity",
				"OpenSource",
				"Criminal",
				"RAT"
			],
			"Threats": [
				{
					"FamilyName": "AsyncRAT"
				}
			],
			"DomainDetails": {
				"Domain": "example-malicious-domain.com"
			}
		}
	]
}
```

## Workflow Library Example

[Search Indicators with Crowdstrike and Send Results Via Email](https://library.blinkops.com/workflows/search-indicators-with-crowdstrike-and-send-results-via-email)

<div className="iframe-wrapper">
  <div className="iframe-media">
    <img src="https://mintcdn.com/blinkops-2/ojHYuDeYX5FWuN8a/img/Icons/play-box.svg?fit=max&auto=format&n=ojHYuDeYX5FWuN8a&q=85&s=b8af968e71438a9499c3223c9bd29fb2" alt="Workflow Library" width="16" height="16" data-path="img/Icons/play-box.svg" />

    Preview this Workflow on desktop
  </div>

  <iframe className="iframe" src="https://library.blinkops.com/workflows/search-indicators-with-crowdstrike-and-send-results-via-email/canvas" />
</div>