crowdstrike-falcon-scheduled-searches

Lists the execution history of CrowdStrike Falcon scheduled searches.

Syntax

crowdstrike-falcon-scheduled-searches [profile=STRING] [name=STRING] [duration=STRING] [from=DATETIME] [to=DATETIME] [order=STRING] [only-success=BOOL] [only-last=BOOL]

Options

profile=STRING: Optional. Connect profile code of CrowdStrike Falcon
name=STRING: Optional. Scheduled search names for filtering (comma-separated). If not specified, all scheduled searches will be processed.
duration=STRING: Optional. Scan only recent data. You should use s(second), m(minute), h(hour), d(day), mon(month) time unit. For example, 10s means data from 10 seconds earlier.
from=DATETIME: Optional. Start time of range. yyyyMMddHHmmss format. If you omit time part, it will be padded by zero.
to=DATETIME: Optional. End time of range. yyyyMMddHHmmss format. If you omit time part, it will be padded by zero.
order=STRING: Optional. Retrieve direction. desc or asc (default: desc). Cannot be used together with the only-last option.
only-success=BOOL: Optional. Retrieve only successful execution result. t or f (default: f)
only-last=BOOL: Optional. Retrieve only the latest execution result. t or f (default: f). The order option cannot be used together.

Output fields

Field	Type	Name	Description
profile	String	Connect profile	Connect profile code
id	String	ID	Search ID
name	String	Name	Search name
created	Date	Created	Search creation time
finish_time	Date	Finish Time	Search finish time
result_count	Int	Result Count	Number of results
from	Date	From	Search window start time
to	Date	To	Search window end time
duration	Int	Duration	Search duration in milliseconds
status	String	Status	Search status
expire_time	Date	Expire Time	Search expiry time
format	String	Format	Report format (json, csv, pdf)