Skip to main content

Documentation Index

Fetch the complete documentation index at: https://docs.blinkops.com/llms.txt

Use this file to discover all available pages before exploring further.

Gets a set of predicates.

​
Basic Parameters

ParameterDescription
CursorSpecify the pagination cursor for the next page of predicates.
IncludesWhitelist of response properties to include as an array of strings.
LimitMax number of records to return.

​
Advanced Parameters

ParameterDescription
AliasFilter by the alias of the predicate.
Correlation IDID to correlate multiple requests.
Transaction IDID for a transaction.

​
Example Output

{
	"_status": {
		"status": 0,
		"code": "string"
	},
	"_meta": {
		"stats": {
			"offset": 0,
			"limit": 0,
			"total": 0
		},
		"origin": {}
	},
	"data": [
		{
			"definition": {
				"$and": [
					{
						"$stringStartsWith": {
							"message.kind": {
								"$value": "email",
								"$assignIfTrue": [
									{
										"$dstIndex": "condition.RoyalMessage.methodEmail",
										"$srcMode": "const",
										"$srcParam": true
									}
								],
								"$assignIfFalse": [
									{
										"$dstIndex": "condition.RoyalMessage.methodEmail",
										"$srcMode": "const",
										"$srcParam": false
									}
								]
							}
						}
					},
					{
						"$stringMatch": {
							"message.sender.email": {
								"$value": "@proofpoint[^\\.]*",
								"$assignIfTrue": [
									{
										"$dstIndex": "condition.RoyalMessage.emailHit",
										"$srcMode": "match"
									},
									{
										"$dstIndex": "condition.RoyalMessage.emailHitFirst",
										"$srcMode": "first"
									},
									{
										"$dstIndex": "condition.RoyalMessage.emailHitLast",
										"$srcMode": "last"
									},
									{
										"$dstIndex": "condition.RoyalMessage.emailHitRange",
										"$srcMode": "array",
										"$srcParam": [
											{
												"$srcMode": "first"
											},
											{
												"$srcMode": "last"
											}
										]
									}
								],
								"$assignIfFalse": [
									{
										"$dstIndex": "condition.RoyalMessage.emailMiss",
										"$srcMode": "param",
										"srcParam": "message.sender.email"
									}
								]
							}
						}
					},
					{
						"$stringBetween": {
							"message.sender.displayName": [
								"king",
								"queen"
							],
							"$assignIfTrue": [
								{
									"$dstIndex": "condition.RoyalMessage.title",
									"$srcMode": "param",
									"$srcParam": "message.sender.displayName"
								}
							]
						}
					}
				]
			},
			"details": {
				"name": "USA Part Codes",
				"description": "Two-letter codes of all USA parts including states, territories and the DC",
				"meta": {}
			},
			"alias": "USA_PART_CODES",
			"iver": 319,
			"kind": "it:predicate:custom:match",
			"purposes": [
				"it:purpose:detection:rule:condition",
				"it:purpose:endpoint:policy:match",
				"it:purpose:exploration:search:filter",
				"it:purpose:authorization:abac:condition"
			],
			"sver": "1.2.3",
			"createdAt": "2018-04-12T16:36:51.700Z",
			"createdBy": {
				"principal": {
					"id": "b73fc7b3-af84-48b6-bb2f-f3afd115a453"
				},
				"clients": [
					{
						"id": "b73fc7b3-af84-48b6-bb2f-f3afd115a453"
					}
				]
			},
			"updatedAt": "2018-04-12T16:36:51.700Z",
			"updatedBy": {
				"principal": {
					"id": "b73fc7b3-af84-48b6-bb2f-f3afd115a453"
				},
				"clients": [
					{
						"id": "b73fc7b3-af84-48b6-bb2f-f3afd115a453"
					}
				]
			},
			"tenant": 123456789,
			"extent": "tenant",
			"status": "active",
			"risk": {
				"default": {}
			},
			"tags": [
				"rules",
				"windows",
				"agent"
			],
			"id": "b73fc7b3-af84-48b6-bb2f-f3afd115a453"
		}
	]
}

​
Workflow Library Example

List Predicates with Proofpoint Itm and Send Results Via Email
Workflow LibraryPreview this Workflow on desktop