Get Actor IOCs - BlinkOps Documentation

Retrieve the IOCs associated with the threat actor. Notes:

Enrichment allows access to actor data for 8 hours without consuming tokens.
Maximum 1 request per second is allowed.

Response fields:

tokenCharged: If false, the request does not consume tokens.
tokensLeft: Shows the remaining token balance.

Parameters

Parameter	Description
End Date	The end date to filter by.
Filter By Time	The time difference to filter by.
Filter By Types	A comma-separated list of IOC types to filter by.
Offset	The offset to start returning results from.
Query	-
Size	The maximum number of results to return. Note: Maximum `1000` results are allowed.
Sort By	The field to sort the results by.
Sort Order	The order to sort the results by.
Start Date	The start date to filter by.
Threat Actor ID	The ID of the threat actor. Can be obtained by the `List Threat Actors` action.

Example Output

{
	"totalUnfilteredCount": "Number",
	"total": "Number",
	"results": [
		{
			"id": "string",
			"linked_entities": [
				{
					"date": "Unix timestamps",
					"description": "String",
					"label": "String",
					"type": "String",
					"value": "String"
				}
			],
			"note": "String",
			"detection_date": "Unix timestamps",
			"reference": {
				"date": "Unix timestamps",
				"description": "String",
				"label": "String",
				"type": "String",
				"value": "String"
			},
			"updated_date": "Unix timestamps",
			"type": "String",
			"value": "String"
		}
	],
	"filters": {
		"types": [
			{
				"key": "String",
				"doc_count": "Number"
			}
		]
	},
	"tokenCharged": "Boolean",
	"tokensLeft": "Number"
}

Workflow Library Example

Get Actor Iocs with Kela and Send Results Via Email

Preview this Workflow on desktop

​Parameters

​Example Output

​Workflow Library Example

Parameters

Example Output

Workflow Library Example