Search Vulnerabilities - BlinkOps Documentation

Search for Vulnerabilities in your environment by providing an FQL filter and paging details. The following permission is required to run this action:

Vulnerabilities: Read.

External DocumentationTo learn more, visit the CrowdStrike documentation.

Basic Parameters

Parameter	Description
After	A pagination token used with the `limit` parameter to manage pagination of results. On your first request, don’t provide an `after` token. On subsequent requests, provide the `after` token from the previous response to continue from that place in the results.
Facet	Select detail blocks to be returned for each vulnerability entity.
Filter	Filter items using a query in Falcon Query Language (FQL). Wildcards * and empty filter values are unsupported. Available filter fields that supports exact match: aid, cid, last_seen_within, status, cve.id, cve.is_cisa_kev, cve.remediation_level, cve.cps_rating, cve.exprt_rating, cve.exploit_status_to_include, cve.severity, host_info.asset_criticality, host_info.asset_roles, host_info.internet_exposure, host_info.tags, host_info.groups, host_info.product_type_desc, host_info.platform_name, suppression_info.is_suppressed, suppression_info.reason. Available filter fields that supports range comparisons (`>`, `<`, `>=`, `<=`): created_timestamp, closed_timestamp, updated_timestamp.

Advanced Parameters

Parameter	Description
Limit	The number of items to return in this response (default: 100, max: 5000). Use with the after parameter to manage pagination of results.
Sort	Sort vulnerabilities by their properties. Available sort options: - updated_timestamp\|asc/desc - closed_timestamp\|asc/desc Can be used in a format \|asc for ascending order or \|desc for descending order.

Example Output

{
	"meta": {
		"query_time": 0,
		"pagination": {
			"limit": 19,
			"total": 1784670,
			"after": "<string>"
		},
		"powered_by": "<string>",
		"trace_id": "<string>"
	},
	"resources": [
		{
			"id": "<string>",
			"cid": "<string>",
			"aid": "<string>",
			"vulnerability_id": "<string>",
			"data_providers": [
				{
					"provider": "<string>"
				}
			],
			"created_timestamp": "<string>",
			"updated_timestamp": "<string>",
			"status": "<string>",
			"apps": [
				{
					"vendor_normalized": "<string>",
					"product_name_version": "<string>",
					"product_name_normalized": "<string>",
					"sub_status": "<string>",
					"remediation": {
						"ids": [
							"<string>"
						]
					},
					"evaluation_logic": {
						"id": "<string>"
					},
					"remediation_info": {
						"recommended_id": "<string>"
					}
				}
			],
			"suppression_info": {
				"is_suppressed": false
			},
			"confidence": "<string>",
			"cve": {
				"id": "<string>"
			}
		},
		{
			"id": "<string>",
			"cid": "<string>",
			"aid": "<string>",
			"vulnerability_id": "<string>",
			"data_providers": [
				{
					"provider": "<string>"
				}
			],
			"created_timestamp": "<string>",
			"updated_timestamp": "<string>",
			"status": "<string>",
			"apps": [
				{
					"vendor_normalized": "<string>",
					"product_name_version": "<string>",
					"product_name_normalized": "<string>",
					"sub_status": "<string>",
					"remediation": {
						"ids": [
							"<string>"
						]
					},
					"evaluation_logic": {
						"id": "<string>"
					},
					"remediation_info": {
						"recommended_id": "<string>"
					}
				}
			],
			"suppression_info": {
				"is_suppressed": false
			},
			"confidence": "<string>",
			"cve": {
				"id": "<string>"
			}
		}
	]
}