Get Application Risks (CVEs) - BlinkOps Documentation

Get application risk (CVE) data for installed applications, using the Application Management API that replaces the deprecated Get CVEs For Application action. Note: This API is rate-limited to 1 call per second per API token.

Basic Parameters

Parameter	Description
Account IDs	A comma-separated list of account IDs to filter by.
Application Names	A comma-separated list of application names to include.
CVE ID Contains	A free-text filter to match by CVE ID.
Cursor	Cursor position returned by the last request. Use to iterate over more than 1000 items. Example: `YWdlbnRfaWQ6NTgwMjkzODE=`.
Include Removals	Select to include CVEs that were removed.
Limit	Limit number of returned items (1-1000). Example: `10`.
Return All Pages	Automatically fetch all resources, page by page.
Severities	A comma-separated list of severities to filter by, for example: `CRITICAL,HIGH`.
Site IDs	A comma-separated list of site IDs to filter by.

Advanced Parameters

Parameter	Description
Count Only	Select to return only the total count of objects.
Group IDs	A comma-separated list of group IDs to filter by.
Risk Updated After	Get only risk data that was significantly updated after or at this timestamp. Recommended for fetching delta-changes.
Sort By	The column to sort the results by.
Sort Order	Select the direction to sort the results by.
Vendors	A comma-separated list of vendors to include, for example: `Microsoft,Apple`.

Example Output

{
	"data": [
		{
			"cveId": "CVE-2024-5915",
			"applicationName": "GlobalProtect",
			"applicationVendor": "Palo Alto Networks",
			"applicationVersion": "6.3.0",
			"severity": "High",
			"endpointName": "<string>",
			"endpointType": "<string>",
			"mitigationStatus": "Not mitigated",
			"mitigationStatusReason": "<string>",
			"mitigationStatusChangedBy": "<string>",
			"mitigationStatusChangeTime": "2026-08-25T18:55:51.000Z",
			"detectionDate": "2026-08-25T18:55:51.000Z",
			"reportConfidence": "Not Defined",
			"exploitCodeMaturity": "Not Defined",
			"remediationLevel": "Not Defined"
		}
	],
	"pagination": {
		"nextCursor": null,
		"totalItems": 1
	}
}

Workflow Library Example

Get Application Risks Cves with Sentinelone and Send Results Via Email

Preview this Workflow on desktop