1. Investigation
Anzenna Public API
  • How To Use the Anzenna Public API
  • AI Governance
    • Query all Shadow AI instances
      POST
    • Get a Shadow AI instance by id
      GET
    • Query all AI interactions
      POST
    • Get an AI interaction by id
      GET
    • List MCP servers
      POST
    • Get an MCP server
      GET
    • Query MCP server installations
      POST
  • Investigation
    • Query all investigations
      POST
    • Start an investigation
      POST
    • Get an investigation by id
      GET
    • Dismiss an investigation
      POST
    • Get detection investigation prompts
      GET
    • Get global investigation prompts
      GET
    • Get user investigation prompts
      GET
    • Query all risk registers
      POST
    • Query all risk register catalog entries
      POST
  • Identity
    • List accounts
      POST
    • Get an account by id
      GET
    • List login events
      POST
    • Get a login event by ID
      GET
    • Query all mfa statuses
      POST
    • Get an MFA status by id
      GET
    • Query all OAuth applications
      POST
    • Get an OAuth application by id
      GET
    • Query all OAuth application instances
      POST
    • Query all password reuse instances
      POST
  • Advanced
    • Execute an advanced query
    • List security events
    • Receive a webhook event
    • Query raw events
  • Detection
    • Query all allowlists
    • Create a new allowlist
    • Delete an allowlist
    • Update an allowlist
    • Get an anomaly by ID
    • Get key finding detections
    • Get detection details
    • List users associated with a given detection
    • Execute a remediation
  • Browser
    • Query all browser applications
    • Get a browser application by id
    • List browser application instances
    • List browser history entries
    • Query all remote machines
    • Get a remote machine by id
    • Query all web host resources
    • Get a web host resource by id
  • Data & IP
    • Query database exfiltration events
    • List file delete events
    • List file movement activities
    • Get file movement activity by id
    • List files used with data exfiltration.
    • Get a specific data exfiltration file
    • List git events
    • Get a specific git event by id
    • List git repositories
    • Get a specific git repository
    • List file sharing instances
    • Query database share grants
    • Query database share user additions
    • List documents
    • Get document by id
    • List DLP policies
    • Get a DLP policy by id
    • List DLP policy detectors
    • Query all DLP alerts
    • Get a DLP alert by id
  • Device
    • List devices
    • Get a device
    • List device applications
    • Get a device application
    • Query device application instances.
    • List device infections
    • Get a device infection
    • List device policies
    • Get a device policy
    • List USB device connection events
    • Get a USB connection event
    • List IDE applications
    • Get an IDE application
    • Query IDE application instances.
  • Email
    • Query all outbound email events
    • Get an outbound email event by id
    • Query all phishing interactions
  • Company
    • List groups
    • Query all people
    • Get departure analysis for a person
    • Get a person by id
    • Add a category to multiple people
    • Remove a category from multiple people
    • Get company risk trends
    • Get number of high risk organizations
  • SaaS
    • Query all Shadow IT instances
  • Outreach
    • List training campaigns
    • Create a training campaign
  • API Key
    • Get API key information
  1. Investigation

Get global investigation prompts

GET
/investigations/global-prompts
Returns the investigation prompts configured at the
organization-wide scope. Investigation prompts are the custom
instructions an analyst has attached to refine how AI
investigations are produced. Global prompts apply to every
investigation in your organization.

Request

Authorization

Responses

🟢200OK
application/json
Successful operation
Bodyapplication/json

🟠401Unauthorized
🟠403Forbidden
Request Request Example
Shell
JavaScript
Java
Swift
curl --location '/investigations/global-prompts'
Response Response Example
{
    "prompts": [
        "Treat after-hours admin logins as CRITICAL."
    ]
}
Modified at 2026-10-20 18:32:30
Previous
Get detection investigation prompts
Next
Get user investigation prompts
Built with