Sign in

v1

latestOpenAPI 3.0.32026-07-2392432.6 KB
investigation

List investigations (with optional filtering, sorting, and search)

Returns a paginated list of investigations. By default, only completed investigations (state='success') are returned. Use query parameters to filter by state, outcomes, priorities, date ranges, and more.

get/app/api/v1/investigation

Query parameters

alert_create_fromstring

Filter by alert creation time (from). ISO 8601 format

alert_create_untilstring

Filter by alert creation time (until). ISO 8601 format

alert_start_fromstring

Filter by alert start time (from). ISO 8601 format (e.g., 2024-01-01 or 2024-01-01T00:00:00Z)

alert_start_untilstring

Filter by alert start time (until). ISO 8601 format

alert_tenantsstring[]

Filter by alert tenant name (can be repeated)

alert_typesstring[]

Filter by alert type/handler key (can be repeated)

attack_surfacesstring[]

Filter by attack surface (can be repeated)

direct_source_labelsstring[]

Filter by alert source label (can be repeated)

feedback_updated_fromstring

Filter by feedback last updated time (from). ISO 8601 format

feedback_updated_untilstring

Filter by feedback last updated time (until). ISO 8601 format

insight_tag_namesstring[]

Filter by insight tag name (can be repeated)

interview_statusesstring[]

Filter by interview status (can be repeated)

inv_complete_fromstring

Filter by investigation completion time (from). ISO 8601 format

inv_complete_untilstring

Filter by investigation completion time (until). ISO 8601 format

investigation_state'error' | 'loading' | 'not_asked' | 'success'

Filter by investigation state. Valid values: not_asked (queued), loading (running), success (complete), error (stopped). Defaults to 'success'.

limitinteger

Number of results per page

mitre_tacticsstring[]

Filter by MITRE ATT&CK tactic (can be repeated)

offsetinteger

Number of results to skip

outcomesstring[]

Filter by investigation outcome/conclusion (can be repeated)

prioritiesstring[]

Filter by investigation priority (can be repeated)

priority_statusesstring[]

Filter by priority status (can be repeated)

searchstring

Free-text search across investigation fields

sort_dir'asc' | 'desc'

Sort direction. Defaults to 'desc'.

sort_type'activity' | 'alert_create' | 'alert_source' | 'alert_title' | 'alert_type' | 'feedback_status' | 'investigation_create' | 'outcome' | 'priority_status' | 'stopped_reason'

Sort field. Defaults to 'alert_create'.

stopped_reasonsstring[]

Filter by stopped reason for error/canceled investigations (can be repeated)

tenant_idstring

Filter by tenant ID

tenant_integration_keystring

Filter by tenant integration key

user_statusesstring[]

Filter by user feedback status (can be repeated)

Response

<strong>Paginated list of investigations</strong> <br><br> Returns a paginated list of investigations. By default, only completed investigations (state='success') are returned. Use query parameters to filter by state, outcomes, priorities, date ranges, and more. <br><br> Use <code>next</code> and <code>previous</code> URLs in the response for easy page navigation. <br><br>

countinteger required

Total number of investigations

nextstring uri nullable required

URL to next page of results

previousstring uri nullable required

URL to previous page of results