List Indicators - BlinkOps Documentation

Retrieve a list of indicators that have communicated with Microsoft Defender for Endpoint cloud. The following permissions are required to run this action:

Ti.ReadWrite
Ti.ReadWrite.All

External DocumentationTo learn more, visit the Microsoft Defender for Endpoint documentation.

Parameters

Parameter	Description
Filter	The filter to apply on the operation. You can filter by `application`, `createdByDisplayName`, `expirationTime`, `generateAlert`, `title`, `rbacGroupNames`, `rbacGroupIds`, `indicatorValue`, `indicatorType`, `creationTimeDateTimeUtc`, `createdBy`, `action`, and `severity`.
Limit	The amount of results which will be returned. Max value is 10,000.
Offset	The offset of the item at which to begin the response.

Example Output

{
  "@odata.context": "https://api.securitycenter.microsoft.com/api/$metadata#Indicators",
  "value": [
    {
      "id": "995",
      "indicatorValue": "12.13.14.15",
      "indicatorType": "IpAddress",
      "action": "Alert",
      "application": "demo-test",
      "source": "TestPrdApp",
      "sourceType": "AadApp",
      "title": "test",
      "creationTimeDateTimeUtc": "2018-10-24T11:15:35.3688259Z",
      "createdBy": "45097602-1234-5678-1234-9f453233e62c",
      "expirationTime": "2020-12-12T00:00:00Z",
      "lastUpdateTime": "2019-10-24T10:54:23.2009016Z",
      "lastUpdatedBy": TestPrdApp,
      "severity": "Informational",
      "description": "test",
      "recommendedActions": "test",
      "rbacGroupNames": []
    },
    {
      "id": "996",
      "indicatorValue": "220e7d15b0b3d7fac48f2bd61114db1022197f7f",
      "indicatorType": "FileSha1",
      "action": "AlertAndBlock",
      "application": null,
      "source": "TestPrdApp",
      "sourceType": "AadApp",
      "title": "test",
      "creationTimeDateTimeUtc": "2018-10-24T10:54:23.2009016Z",
      "createdBy": "45097602-1234-5678-1234-9f453233e62c",
      "expirationTime": "2020-12-12T00:00:00Z",
      "lastUpdateTime": "2019-10-24T10:54:23.2009016Z",
      "lastUpdatedBy": TestPrdApp,
      "severity": "Informational",
      "description": "test",
      "recommendedActions": "TEST",
      "rbacGroupNames": [ "Group1", "Group2" ]
    }
    ...
  ]
}

Workflow Library Example

List Indicators with Microsoft Defender for Endpoint and Send Results Via Email

Preview this Workflow on desktop

​Parameters

​Example Output

​Workflow Library Example

Parameters

Example Output

Workflow Library Example