Interface BitsSecurityAnalystApiCountSecurityAgentInvestigationsRequest

Field to count completed investigations by.

Only investigations whose signal has all of these entities. Write each entity as attribute:value, matching the values returned by the count endpoint with field=entity. Comma-separated values; an investigation must have every one of them.

Only investigations last updated at or after this time, as RFC 3339 or milliseconds since the epoch.

Only investigations of signals from one of these detection rule IDs. Comma-separated values; an investigation matches any of them.

Only investigations of signals from detection rules of one of these types, as returned by the count with field=rule_type. Comma-separated values; an investigation matches any of them.

Only investigations of signals with one of these severities: info, low, medium, high, or critical. Comma-separated values; an investigation matches any of them.

Only investigations of signals from one of these sources, as returned by the count with field=signal_source. Comma-separated values; an investigation matches any of them.

Only investigations whose signal has all of these tags, written key:value. Comma-separated values; an investigation must have every one of them.

Only investigations whose signal title contains this text, case-insensitive.

Only investigations last updated at or before this time, as RFC 3339 or milliseconds since the epoch.

Only investigations with one of these verdicts: benign, suspicious, or malicious. Comma-separated values; an investigation matches any of them.