Feedback:

cs_query_alerts

Note:  

  • Access to this operator is provided on a limited-availability basis. Contact Anomali Customer Support for more information.

  • The cs_query_alerts operator replaces the cs_query_detects operator, which is now deprecated. See Migration for details.

Use the cs_query_alerts operator to search for alerts using a filter specified in CrowdStrike Falcon Query Language (FQL).

The search results are returned in the resources array (displayed as the RESOURCES column in the UI). You can reference this array in subsequent CrowdStrike operators, such as cs_get_alert_entities, to retrieve alert details for the listed alerts.

Syntax

| cs_query_alerts [cs_filter=<filter> cs_sort=<sort_criteria> cs_limit=<max_results> cs_offset=<offset> cs_include_hidden=<boolean>]

cs_filter=<filter>

Optional. Specify a CrowdStrike Falcon Query Language (FQL) filter expression to reduce the number of results. The expression format is as follows: cs_filter="<filter>:<filter_value>"

For example:

  • status:'new'

  • severity:>=50

cs_sort=<sort_criteria>

Optional. Specify a sort criteria by which to sort the results.
Possible values, and the sort order:

  • first_behavior: Timestamp of the first behavior associated with this detection.

  • last_behavior: Timestamp of the last behavior associated with this detection.

  • max_severity: Highest severity of the behaviors associated with this detection.

  • max_confidence: Highest confidence of the behaviors associated with this detection.

  • adversary_id: ID of the adversary, if any, associated with this detection.

  • devices.hostname: Hostname of the host where this detection was detected.

Specify the sort order: asc | desc
cs_limit=<max_results>

Optional. Specify the maximum number of results to return.

Default value: 100

Maximum value: 10,000
cs_offset=<offset>

Optional. Specify the number of results to skip before returning results. Use in conjunction with cs_limit=<max_results_return> to paginate results. Refer to Offsetting Query Results for details.

Default value: 0
cs_include_hidden=<boolean>

Optional. Specify whether to include hidden alerts.

Possible values:

  • true

  • false

Default value: true

Offsetting Query Results

When using pagination with the cs_query_alerts operator, the combined value of cs_limit and cs_offset must not exceed 10,000. This restriction is enforced by the CrowdStrike API and defines the maximum accessible result window. As a result, pagination is supported only within the first 10,000 matching records.

If a query returns more than 10,000 results, additional records cannot be retrieved using offset-based pagination alone. To access the full dataset, refine the query using filters (for example, time range, severity, or other attributes) to reduce the result set and page through each filtered subset separately.

Examples

Example 1: Query new alerts with a limit of 500 results.

Copy 
| cs_query_alerts cs_filter="status:'new'" cs_limit=500

 

Example 2: Query high-severity alerts (≥ 50) sorted by last behavior in descending order.

Copy 
| cs_query_alerts cs_filter="severity:>=50" cs_sort="last_behavior|desc"

 

Example 3: Query up to 300 new alerts and skip the first 100 matching alerts.

Copy 
| cs_query_alerts cs_filter="status:'new'" cs_limit=300 cs_offset=100

 

Example 4: Query five alerts, retrieve output in resources, extract process IDs that triggered the alerts, and get details about these process IDs in processid. For more information on resources, see the operator description above.

Copy 
| cs_query_alerts cs_limit=5
| cs_get_alert_entities cs_id_list=resources
| calc processid = json_extract(response, "triggering_process_graph_id")
| cs_get_process_detail cs_id_list=processid

Migration

The cs_query_detects operator is deprecated and replaced by cs_query_alerts. If you currently use cs_query_detects to retrieve alert data, update your queries to use cs_query_alerts.

Use the following example to migrate existing queries to the cs_query_alerts operator:

Before After
| cs_query_detects cs_filter="status:'new'" | cs_query_alerts cs_filter="status:'new'"