1. investigations
Anzenna Public API
  • How To Use the Anzenna Public API
  • data exfiltration
    • Query database exfiltration events
      POST
    • List file delete events
      POST
    • List file movement activities
      POST
    • Get file movement activity by id
      GET
    • List files used with data exfiltration.
      POST
    • Get a specific data exfiltration file
      GET
    • List git events
      POST
    • Get a specific git event by id
      GET
    • List git repositories
      POST
    • Get a specific git repository
      GET
  • api key
    • Get API key information
      GET
  • login events
    • List login events
      POST
    • Get a login event by ID
      GET
  • browser applications
    • Query all browser applications
      POST
    • Get a browser application by id
      GET
    • List browser application instances
      POST
  • browser history
    • List browser history entries
      POST
  • data sharing
    • List file sharing instances
      POST
    • Query database share grants
      POST
    • Query database share user additions
      POST
    • List documents
      POST
    • Get document by id
      GET
  • devices
    • List devices
    • Get a device
    • List USB device connection events
    • Get a USB connection event
  • device policies
    • List device policies
    • Get a device policy
  • device applications
    • List device applications
    • Get a device application
    • Query device application instances.
  • device infections
    • List device infections
    • Get a device infection
  • ide applications
    • List IDE applications
    • Get an IDE application
  • ide application instances
    • Query IDE application instances.
  • mcp servers
    • List MCP servers
    • Get an MCP server
    • Query MCP server installations
  • mfa
    • Query all mfa statuses
    • Get an MFA status by id
  • oauth applications
    • Query all OAuth applications
    • Get an OAuth application by id
    • Query all OAuth application instances
  • passwords
    • Query all password reuse instances
  • people
    • Query all people
    • Get departure analysis for a person
    • Get a person by id
    • Add a category to multiple people
    • Remove a category from multiple people
  • account
    • List accounts
    • Get an account by id
  • phishing interactions
    • Query all phishing interactions
  • email flows
    • Query all outbound email events
    • Get an outbound email event by id
  • company wide risk trends
    • Get company risk trends
  • high risk organizations
    • Get number of high risk organizations
  • detections
    • Get key finding detections
    • Get detection details
    • List users associated with a given detection
  • events
    • List security events
  • shadow it
    • Query all Shadow IT instances
  • web host
    • Query all web host resources
    • Get a web host resource by id
  • advanced query
    • Execute an advanced query
  • sources
    • Query raw events
  • allowlist
    • Query all allowlists
    • Create a new allowlist
    • Delete an allowlist
    • Update an allowlist
  • anomalies
    • Get an anomaly by ID
  • groups
    • List groups
  • investigations
    • Query all investigations
      POST
    • Get an investigation by id
      GET
    • Get detection investigation prompts
      GET
    • Get global investigation prompts
      GET
    • Get user investigation prompts
      GET
  • rdp connections
    • Query all remote machines
    • Get a remote machine by id
  • risk registers
    • Query all risk registers
    • Query all risk register catalog entries
  • shadow ai
    • Query all Shadow AI instances
    • Get a Shadow AI instance by id
  • training
    • List training campaigns
    • Create a training campaign
  • webhooks
    • Receive a webhook event
  • ai audits
    • Query all AI audit events
    • Get an AI audit event by id
  • dlp policies
    • List DLP policies
    • Get a DLP policy by id
    • List DLP policy detectors
  • remediations
    • Execute a remediation
  • dlp alerts
    • Query all DLP alerts
    • Get a DLP alert by id
  1. investigations

Get an investigation by id

GET
/investigations/{id}
Get an investigation by its unique identifier

Request

Authorization
Path Params

Responses

🟢200OK
application/json
Successful operation
Bodyapplication/json

🟠401Unauthorized
🟠403Forbidden
Request Request Example
Shell
JavaScript
Java
Swift
curl --location '/investigations/'
Response Response Example
{
    "created": "2024-01-15T10:30:00Z",
    "detection": {
        "event_count": 0,
        "kind": "LOGIN_AUDIT",
        "name": "string",
        "user_count": 0
    },
    "detection_id": "A1B2C3D4-5678-9012-3456-789012345678",
    "evidence": [
        {
            "asset_name": "string",
            "description": "string",
            "employee_email": "string",
            "event_id": "string",
            "event_type": "string",
            "happened": "2019-08-24T14:15:22.123Z",
            "note_summary": "string",
            "risk_score": 0,
            "source": "unspecified"
        }
    ],
    "headline": "Unusual data exfiltration to personal cloud storage",
    "id": "8CA67511-744C-4D74-B26E-7281CF88712F",
    "is_pinned": true,
    "outcome": "info",
    "person": {
        "department": "string",
        "email": "string",
        "job_title": "string",
        "location": "string",
        "manager_email": "string",
        "manager_name": "string",
        "name": "string",
        "risk_score": 0,
        "state": "unspecified"
    },
    "person_id": "alice@example.com",
    "report": {
        "analysis_window": {
            "end": "2019-08-24T14:15:22.123Z",
            "start": "2019-08-24T14:15:22.123Z"
        },
        "confidence_level": 0.85,
        "notes": [
            {
                "event_query": "string",
                "event_refs": [
                    {
                        "event_id": "string",
                        "parent_id": "string"
                    }
                ],
                "summary": "string",
                "time_window": {
                    "end": "2019-08-24T14:15:22.123Z",
                    "start": "2019-08-24T14:15:22.123Z"
                }
            }
        ],
        "recommended_action": "INFO",
        "summary": "string"
    },
    "risk_score": 75,
    "status": "open",
    "updated": "2024-01-15T12:00:00Z"
}
Modified at 2026-07-24 15:31:52
Previous
Query all investigations
Next
Get detection investigation prompts
Built with