Query all investigations

POST

/investigations

Query and filter AI-driven investigations of security detections

Relations:

person (Person): The person associated with this investigation

Request

Authorization

Body Params application/jsonRequired

Examples

Responses

🟢200OK

application/json

Successful operation

Bodyapplication/json

🟠400Bad Request

🟠401Unauthorized

🟠403Forbidden

Request Example

Shell

JavaScript

Java

Swift

curl --location '/investigations' \
--header 'Content-Type: application/json' \
--data '{
    "distinct_count": "string",
    "distinct_on": "host_name",
    "include_total_count": true,
    "limit": 10,
    "offset": 0,
    "query": "name='\''WINPC-4291'\'' AND status IN ('\''active'\'', '\''pending'\'')",
    "sort": "name desc, id"
}'

Response Example

{
    "distinct_values": [
        {
            "count": 0,
            "value": null
        }
    ],
    "pagination": {
        "count": 0,
        "total_count": 1000
    },
    "items": [
        {
            "created": "2024-01-15T10:30:00Z",
            "detection": {
                "event_count": 0,
                "kind": "LOGIN_AUDIT",
                "name": "string",
                "user_count": 0
            },
            "detection_id": "A1B2C3D4-5678-9012-3456-789012345678",
            "evidence": [
                {
                    "asset_name": "string",
                    "description": "string",
                    "employee_email": "string",
                    "event_id": "string",
                    "event_type": "string",
                    "happened": "2019-08-24T14:15:22.123Z",
                    "note_summary": "string",
                    "risk_score": 0,
                    "source": "unspecified"
                }
            ],
            "headline": "Unusual data exfiltration to personal cloud storage",
            "id": "8CA67511-744C-4D74-B26E-7281CF88712F",
            "is_pinned": true,
            "outcome": "info",
            "person": {
                "department": "string",
                "email": "string",
                "job_title": "string",
                "location": "string",
                "manager_email": "string",
                "manager_name": "string",
                "name": "string",
                "risk_score": 0,
                "state": "unspecified"
            },
            "person_id": "alice@example.com",
            "report": {
                "analysis_window": {
                    "end": "2019-08-24T14:15:22.123Z",
                    "start": "2019-08-24T14:15:22.123Z"
                },
                "confidence_level": 0.85,
                "notes": [
                    {
                        "event_query": "string",
                        "event_refs": [
                            {
                                "event_id": "string",
                                "parent_id": "string"
                            }
                        ],
                        "summary": "string",
                        "time_window": {
                            "end": "2019-08-24T14:15:22.123Z",
                            "start": "2019-08-24T14:15:22.123Z"
                        }
                    }
                ],
                "recommended_action": "INFO",
                "summary": "string"
            },
            "risk_score": 75,
            "status": "open",
            "updated": "2024-01-15T12:00:00Z"
        }
    ]
}

Modified at 2026-07-24 15:31:52

List groups

Get an investigation by id