> ## Documentation Index
> Fetch the complete documentation index at: https://docs.blinkops.com/llms.txt
> Use this file to discover all available pages before exploring further.

# List Indicators

Retrieve a list of indicators that have communicated with Microsoft Defender for Endpoint cloud.

The following permissions are required to run this action:

* `Ti.ReadWrite`
* `Ti.ReadWrite.All`

<Note>
  External Documentation

  To learn more, visit the [Microsoft Defender For Endpoints documentation](https://learn.microsoft.com/en-us/defender-endpoint/api/get-ti-indicators-collection).
</Note>

## Parameters

<div className="integrations-table">
  | Parameter | Description                                                                                                                                                                                                                                                                       |
  | --------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
  | Filter    | The filter to apply on the operation. You can filter by `application`, `createdByDisplayName`, `expirationTime`, `generateAlert`, `title`, `rbacGroupNames`, `rbacGroupIds`, `indicatorValue`, `indicatorType`, `creationTimeDateTimeUtc`, `createdBy`, `action`, and `severity`. |
  | Limit     | The amount of results which will be returned. Max value is 10,000.                                                                                                                                                                                                                |
  | Offset    | The offset of the item at which to begin the response.                                                                                                                                                                                                                            |
</div>

## Example Output

```json theme={"dark"}
{
  "@odata.context": "https://api.securitycenter.microsoft.com/api/$metadata#Indicators",
  "value": [
    {
      "id": "995",
      "indicatorValue": "12.13.14.15",
      "indicatorType": "IpAddress",
      "action": "Alert",
      "application": "demo-test",
      "source": "TestPrdApp",
      "sourceType": "AadApp",
      "title": "test",
      "creationTimeDateTimeUtc": "2018-10-24T11:15:35.3688259Z",
      "createdBy": "45097602-1234-5678-1234-9f453233e62c",
      "expirationTime": "2020-12-12T00:00:00Z",
      "lastUpdateTime": "2019-10-24T10:54:23.2009016Z",
      "lastUpdatedBy": TestPrdApp,
      "severity": "Informational",
      "description": "test",
      "recommendedActions": "test",
      "rbacGroupNames": []
    },
    {
      "id": "996",
      "indicatorValue": "220e7d15b0b3d7fac48f2bd61114db1022197f7f",
      "indicatorType": "FileSha1",
      "action": "AlertAndBlock",
      "application": null,
      "source": "TestPrdApp",
      "sourceType": "AadApp",
      "title": "test",
      "creationTimeDateTimeUtc": "2018-10-24T10:54:23.2009016Z",
      "createdBy": "45097602-1234-5678-1234-9f453233e62c",
      "expirationTime": "2020-12-12T00:00:00Z",
      "lastUpdateTime": "2019-10-24T10:54:23.2009016Z",
      "lastUpdatedBy": TestPrdApp,
      "severity": "Informational",
      "description": "test",
      "recommendedActions": "TEST",
      "rbacGroupNames": [ "Group1", "Group2" ]
    }
    ...
  ]
}
```

## Workflow Library Example

[List Indicators with Microsoft Defender for Endpoints and Send Results Via Email](https://library.blinkops.com/workflows/list-indicators-with-microsoft-defender-for-endpoints-and-send-results-via-email)

<div className="iframe-wrapper">
  <div className="iframe-media">
    <img src="https://mintcdn.com/blinkops-2/ojHYuDeYX5FWuN8a/img/Icons/play-box.svg?fit=max&auto=format&n=ojHYuDeYX5FWuN8a&q=85&s=b8af968e71438a9499c3223c9bd29fb2" alt="Workflow Library" width="16" height="16" data-path="img/Icons/play-box.svg" />

    Preview this Workflow on desktop
  </div>

  <iframe className="iframe" src="https://library.blinkops.com/workflows/list-indicators-with-microsoft-defender-for-endpoints-and-send-results-via-email/canvas" />
</div>