Query Custom Graph - BlinkOps Documentation

Run a Graph Query Language (GQL) query against a custom graph in Microsoft Sentinel data lake.

External DocumentationTo learn more, visit the Microsoft Sentinel Data Lake documentation.

Parameters

Parameter	Description
Graph Name	The name of the custom graph to query.
Query	The GQL query to execute.
Response Formats	Select the format of the query results.

Example Output

{
	"status": 200,
	"result": {
		"rawData": {
			"tables": [
				{
					"tableName": "PrimaryResult",
					"columns": [
						{
							"columnName": "u",
							"dataType": "dynamic"
						}
					],
					"rows": [
						[
							{
								"oid": "node-user-001",
								"labels": [
									"User"
								],
								"properties": {
									"name": "Aino Rebane",
									"email": "aino.rebane@contoso.com",
									"department": "Engineering"
								}
							}
						]
					]
				}
			]
		},
		"graph": {
			"nodes": [
				{
					"id": "node-user-001",
					"labels": [
						"User"
					],
					"properties": {
						"name": "Aino Rebane",
						"email": "aino.rebane@contoso.com",
						"department": "Engineering"
					}
				}
			],
			"edges": [
				{
					"id": "edge-001",
					"sourceId": "node-user-001",
					"targetId": "node-group-001",
					"labels": [
						"HasRole"
					],
					"properties": {
						"assignedDate": "2024-01-15T10:30:00Z",
						"assignedBy": "admin@contoso.com"
					}
				}
			]
		}
	},
	"correlationId": "aaaa0000-bb11-2222-33cc-444444dddddd"
}

Workflow Library Example

Query Custom Graph with Microsoft Sentinel Data Lake and Send Results Via Email

Preview this Workflow on desktop

Microsoft Sentinel Data Lake Custom Action Query Data Lake

⌘I

​Parameters

​Example Output

​Workflow Library Example

Parameters

Example Output

Workflow Library Example