Optional filterOptional filterOnly investigations last updated at or after this time, as RFC 3339 or milliseconds since the epoch.
Optional filterOnly investigations of signals from one of these detection rule IDs. Comma-separated values; an investigation matches any of them.
Optional filterOnly investigations of signals from detection rules of one of these types, as returned by the count with
field=rule_type. Comma-separated values; an investigation matches any of them.
Optional filterList every investigation of this signal, newest first. Accepts the signal ID in its V1 form, which starts
with AQ, or in its longer V3 form, which starts with Aw. Investigations carry the V1 form, so their
signal_id can differ from the ID you pass. Can't be combined with other filters or with sort.
Optional filterOnly investigations of signals with one of these severities: info, low, medium, high, or critical.
Comma-separated values; an investigation matches any of them.
Optional filterOnly investigations of signals from one of these sources, as returned by the count with
field=signal_source. Comma-separated values; an investigation matches any of them.
Optional filterOnly investigations in one of these states: investigating or completed. Investigations reported as
failed match investigating. Comma-separated values; an investigation matches any of them.
Optional filterOnly investigations whose signal has all of these tags, written key:value. Comma-separated values; an
investigation must have every one of them.
Optional filterOnly investigations whose signal title contains this text, case-insensitive.
Optional filterOnly investigations last updated at or before this time, as RFC 3339 or milliseconds since the epoch.
Optional filterOnly investigations with one of these verdicts: benign, suspicious, or malicious.
Comma-separated values; an investigation matches any of them.
Optional pagePage number, starting at 1.
Optional pageNumber of investigations per page.
Optional sortSort field, prefixed with - for descending: updated_at, severity, verdict, rule_id, or signal_title.
Defaults to -updated_at. verdict sorts by severity (benign, suspicious, malicious), so -verdict puts
malicious first.
Generated using TypeDoc
Only investigations whose signal has all of these entities. Write each entity as
attribute:value, matching the values returned by the count endpoint withfield=entity. Comma-separated values; an investigation must have every one of them.