Run Query - BlinkOps Documentation

Run an advanced The following permissions are required to run this action:

Alert.Read.All
Alert.ReadWrite.All

External DocumentationTo learn more, visit the Microsoft Defender for Endpoint documentation.

Parameters

Parameter	Description
Query	Your advanced hunting query.

Example Output

{
	"Schema": [
		{
			"Name": "Timestamp",
			"Type": "DateTime"
		},
		{
			"Name": "FileName",
			"Type": "String"
		},
		{
			"Name": "InitiatingProcessFileName",
			"Type": "String"
		},
		{
			"Name": "DeviceId",
			"Type": "String"
		}
	],
	"Results": [
		{
			"Timestamp": "2020-02-05T01:10:26.2648757Z",
			"FileName": "csc.exe",
			"InitiatingProcessFileName": "powershell.exe",
			"DeviceId": "10cbf9182d4e95660362f65cfa67c7731f62fdb3"
		},
		{
			"Timestamp": "2020-02-05T01:10:26.5614772Z",
			"FileName": "csc.exe",
			"InitiatingProcessFileName": "powershell.exe",
			"DeviceId": "10cbf9182d4e95660362f65cfa67c7731f62fdb3"
		}
	]
}

Workflow Library Example

Run Query with Microsoft Defender for Endpoint and Send Results Via Email

Preview this Workflow on desktop

Run Antivirus Scan Run Script On Machine

⌘I

​Parameters

​Example Output

​Workflow Library Example

Parameters

Example Output

Workflow Library Example