Skip to main content
Retrieve a list of indicators with optional filtering.

​
Basic Parameters

ParameterDescription
FiltersA filter parameter that accepts a subset of MongoDB-style queries to filter by. Supported operators may differ based on the field’s data type.

Available attributes: value, type, test, active, internalHits, externalHits, expiresAt, source, sharedWith, firstSeen, lastSeen, reputation, comments

For Example:

* Find all indicators with reputation greater than 5 and externalHits more than 10.
{
    “and": [<br/>      &#123;<br/>        "reputation": &#123;<br/>          "gt”: 5
        }
      },
      {
        “externalHits”: {
          “gt": 10<br/>        &#125;<br/>      &#125;<br/>    ]<br/>  &#125;<br/></code></pre>* Find all indicators that have been shared with "Netskope Partners" configuration.<br/>  <pre><code>&#123;<br/>    "sharedWith": &#123;<br/>      "in”: [“Netskope Partners”]
    }
  }
* Not operator is only supported for regex matches.
{
    “value”: {
      “$not”: ”^(db.tt)”
    }
  }
To learn more about building MongoDB queries, please visit MongoDB documentation.
Return All PagesAutomatically fetch all resources, page by page.

​
Advanced Parameters

ParameterDescription
AggregateSelect to retrieve indicators in an aggregated form.
Ascending OrderSelect to retrieve indicators in an ascending order.
LimitThe number of results to return per page.
SkipThe number of results to initially skip.
Sort FieldA field to sort the results by.

​
Example Output

[
	{
		"value": "string",
		"type": "url",
		"test": true,
		"safe": false,
		"active": true,
		"internalHits": 0,
		"externalHits": 0,
		"expiresAt": "2025-08-17T09:25:36.774Z",
		"source": "string",
		"sharedWith": [
			"string"
		],
		"tags": [],
		"firstSeen": "2025-08-17T09:25:36.775Z",
		"lastSeen": "2025-08-17T09:25:36.775Z",
		"reputation": 0,
		"severity": "unknown",
		"comments": "string",
		"extendedInformation": "",
		"sources": []
	}
]

​
Workflow Library Example

List Indicators with Netskope Cte and Send Results Via Email
Workflow LibraryPreview this Workflow on desktop
⌘I