Feedback:

cs_query_device

Note: Access to this operator is provided on a limited-availability basis. Contact Anomali Customer Support for more information.

Use the cs_query_device operator to query devices in your environment. You can search by platform, hostname, IP address, and other attributes.

The device identifiers are returned in the AID output field. You can use this field with the cs_hunt_domain, cs_hunt_file, cs_hunt_ip, and cs_query_device operators to perform analysis and threat hunting.

Syntax

| cs_query_device [cs_filter=<filter> cs_limit=<max_results>]

cs_filter=<filter>

Optional. Specify a CrowdStrike Falcon Query Language (FQL) filter expression to reduce the number of results. The expression format is as follows: cs_filter="<filter>:<filter_value>"

For example:

  • status:'new'

  • severity:>=50

cs_limit=<max_results>

Optional. Specify the maximum number of device AIDs to return.

Default value: 5000

Maximum value: 10,000

Examples

Example 1: Retrieve the device with the specified host name.

Copy 
| cs_query_device cs_filter="hostname:'WS01'"

 

Example 2: Retrieve devices with the specified platform name and get system details for them.

Copy 
| cs_query_device cs_filter="platform_name:'Windows'" 
| cs_get_system_info cs_id_list=AID