Search Users

Search for CrowdStrike users.

Options

Field Definition Type Required

Result Set

Choose a method to filter search results:

  • First Matching Record: Returns the first record that matches.

  • First 100 Matching Records: Returns the first 100 matching records.

  • Stream Matching Records: Passes all matching records from your parent flow to a helper flow.

    Selecting this option adds a Streaming input section to the card where you can select a helper flow for streaming and add custom extensible fields.

Dropdown

TRUE

Input

Field Definition Type Required

Search Criteria

First Name

Given name of the user.

Text

FALSE

Last Name

Last name of the user.

Text

FALSE

Email

The email address of the user.

Text

FALSE

Full Name

Full name of the user.

You can find a user by their first and family names separated by a space.

Text

FALSE

Assigned CID

Find users that have been given access to the specified CID.

Text

FALSE

CID

The customer ID of the CrowdStrike user.

For Falcon Complete Cloud Security customers, this is the user record where the home CID matches the specified CID.

Text

FALSE

Sort

The attribute and direction to order the results.

  • Email - Ascending. This is the default.

  • Created At - Ascending

  • Created At - Descending

  • First Name - Ascending

  • First Name - Descending

  • Last Login - Ascending

  • Last Login - Descending

  • Last Name - Ascending

  • Last Name - Descending

  • Name - Ascending

  • Name - Descending

  • Email - Descending

Dropdown

FALSE

Streaming

Flow

Click Choose Flow to browse and select a helper flow where the search results will be streamed, then click Choose to confirm.

Optionally, click the empty field under Click or drop here to create and add custom extensible fields that pass data to the helper flow. These fields are added as key/value pairs under the State output object in the helper flow.

This field appears when you select Stream Matching Records from the Result Set option.

To learn how to return large numbers of records, see Stream matching records with a helper flow.

Flow

TRUE

Record Limit

Specify the number of records to stream.

  • The Record Limit field can't be set to 0.

  • When the Record Limit field is set to greater than 0, the stream returns up to the maximum number specified.

  • When the Record Limit field is empty, null, or not selected, the stream returns all records.

  • The default value is 500000.

  • The valid range is from 0 to 500000.

This field appears when you select Stream Matching Records from the Result Set option.

Number

FALSE

Output

Field Definition Type

Result

Users

List of Objects

User ID

Unique user ID of the user.

Text

CID

The customer ID of the CrowdStrike user.

Text

Email

The email address of the user.

Text

Status

Status of the user.

Text

First Name

Given name of the user.

Text

Last Name

Last name of the user.

Text

Last Login At

Date and time when the user last signed in.

Date & Time

Created At

Date and time when the object was created.

Date & Time

Updated At

Date and time when the object was updated.

Date & Time

Records Streamed

Number of records streamed in a streaming flow.

This field appears when you select Stream Matching Records from the Result Set option.

Number

Related topics

CrowdStrike connector

Cards in flows

To access the CrowdStrike API documentation, sign in to your CrowdStrike Falcon console.