Search Investigations - BlinkOps Documentation

Search investigations using the Taegis XDR Query Language (CQL).

External DocumentationTo learn more, visit the Secureworks Taegis XDR documentation.

Parameters

Parameter	Description
CQL Query	The Taegis XDR Query Language (CQL) query to search the investigations by. For Example: `status IN ('Open', 'Awaiting Action') and createdAt >= '2024-07-19T21:55:28.163531Z'` Note: Aggregations, `HEAD`, `TAIL` and joins are not supported. Use `Page` and `Per Page` to paginate, and a `\| sort by` clause to order the results.\|
Page	The page of results to return. Pages start at `1`.
Per Page	The maximum number of investigations to return per page. Defaults to `100`.
Return All Pages	Automatically fetch all resources, page by page.
Tenant Service Filters	A comma-separated list of the tenant service labels to filter the investigations by.

Workflow Library Example

Search Investigations with Secureworks Taegis Xdr and Send Results Via Email

Preview this Workflow on desktop