Search Query By ID - BlinkOps Documentation

Search SIEM query by ID. Note: If you used the Advanced Search Query action, experienced a timeout, and received the search ID, you can use this action to retrieve the results from the search, as long as 90 seconds have not passed since the timeout (after which the search is automatically removed from crowdstrike’s database)

External DocumentationTo learn more, visit the CrowdStrike documentation.

Parameters

Parameter	Description
Repository	The repository to run the query against.
Search ID	The ID of the query job to retrieve results for. Can be obtained using `Advanced Search Query` Action.

Example Output

{
	"cancelled": false,
	"done": true,
	"events": [
		{
			"timestamp": "1736264422005",
			"ImageSubsystem": "2",
			"RawProcessId": "60",
			"@sourcetype": "xdr/xdr-base-parsers:falcon-raw-data",
			"@timezone": "Z",
			"Tags": "41, 53, 54, 55, 236",
			"ParentBaseFileName": "host.exe",
			"Entitlements": "15",
			"@id": "XQZxxxxxxxVP9_xxx_xx_xxxxxxx",
			"LocalAddressIP4": "xxx.xx.x.xx",
			"@ingesttimestamp": "1736264423894",
			"aip": "xxx.xxx.xx.x",
			"@timestamp": 1736264422005,
			"LocalIP": "xxx.xx.x.xx",
			"name": "ProcessRollup2V19",
			"UserName": "USER3",
			"#type": "falcon-raw-data",
			"SessionId": "0",
			"SourceThreadId": "233xxxx363",
			"aid": "abc123",
			"ProcessParameterFlags": "24577",
			"ProcessStartTime": "1736264421.987",
			"SHA1HashData": "0000000000000000000000000000000000000000"
		},
		{
			"timestamp": "1736264422006",
			"ImageSubsystem": "3",
			"RawProcessId": "63",
			"@sourcetype": "xdr/xdr-base-parsers:falcon-raw-data",
			"@timezone": "Z",
			"Tags": "41, 53, 54, 55, 236",
			"ParentBaseFileName": "host.exe",
			"Entitlements": "15",
			"@id": "XQZxxxxxxxVP9_xxx_xx_xxxxxxx",
			"LocalAddressIP4": "xxx.xx.x.xx",
			"@ingesttimestamp": "1736264423894",
			"aip": "xxx.xxx.xx.x",
			"@timestamp": 1736264422005,
			"LocalIP": "xxx.xx.x.xx",
			"name": "ProcessRollup2V19",
			"UserName": "USER3",
			"#type": "falcon-raw-data",
			"SessionId": "0",
			"SourceThreadId": "233xxxx363",
			"aid": "abc123",
			"ProcessParameterFlags": "24577",
			"ProcessStartTime": "1736264421.987",
			"SHA1HashData": "0000000000000000000000000000000000000000"
		}
	]
}