Search Query By ID - BlinkOps Documentation

Search SIEM query by ID. Note: If you used the Advanced Search Query action, experienced a timeout, and received the search ID, you can use this action to retrieve the results from the search, as long as 90 seconds have not passed since the timeout (after which the search is automatically removed from crowdstrike’s database)

External DocumentationTo learn more, visit the CrowdStrike documentation.

Parameters

Parameter	Description
Repository	The repository to run the query against. For info about repository options, see Repositories.
Search ID	The ID of the query job to retrieve results for. Can be obtained using `Advanced Search Query` Action.

Example Output

{
	"cancelled": false,
	"done": true,
	"events": [
		{
			"timestamp": "1736264422005",
			"ImageSubsystem": "2",
			"RawProcessId": "60",
			"@sourcetype": "xdr/xdr-base-parsers:falcon-raw-data",
			"@timezone": "Z",
			"Tags": "41, 53, 54, 55, 236",
			"ParentBaseFileName": "host.exe",
			"Entitlements": "15",
			"@id": "XQZxxxxxxxVP9_xxx_xx_xxxxxxx",
			"LocalAddressIP4": "xxx.xx.x.xx",
			"@ingesttimestamp": "1736264423894",
			"aip": "xxx.xxx.xx.x",
			"@timestamp": 1736264422005,
			"LocalIP": "xxx.xx.x.xx",
			"name": "ProcessRollup2V19",
			"UserName": "USER3",
			"#type": "falcon-raw-data",
			"SessionId": "0",
			"SourceThreadId": "233xxxx363",
			"aid": "abc123",
			"ProcessParameterFlags": "24577",
			"ProcessStartTime": "1736264421.987",
			"SHA1HashData": "0000000000000000000000000000000000000000"
		},
		{
			"timestamp": "1736264422006",
			"ImageSubsystem": "3",
			"RawProcessId": "63",
			"@sourcetype": "xdr/xdr-base-parsers:falcon-raw-data",
			"@timezone": "Z",
			"Tags": "41, 53, 54, 55, 236",
			"ParentBaseFileName": "host.exe",
			"Entitlements": "15",
			"@id": "XQZxxxxxxxVP9_xxx_xx_xxxxxxx",
			"LocalAddressIP4": "xxx.xx.x.xx",
			"@ingesttimestamp": "1736264423894",
			"aip": "xxx.xxx.xx.x",
			"@timestamp": 1736264422005,
			"LocalIP": "xxx.xx.x.xx",
			"name": "ProcessRollup2V19",
			"UserName": "USER3",
			"#type": "falcon-raw-data",
			"SessionId": "0",
			"SourceThreadId": "233xxxx363",
			"aid": "abc123",
			"ProcessParameterFlags": "24577",
			"ProcessStartTime": "1736264421.987",
			"SHA1HashData": "0000000000000000000000000000000000000000"
		}
	]
}

Workflow Library Example

Search Query by Id with Crowdstrike and Send Results Via Email

Preview this Workflow on desktop

Search Indicators Search Vulnerabilities

⌘I

​Parameters

​Example Output

​Workflow Library Example

Parameters

Example Output

Workflow Library Example