Get alert investigation.

Parameters

ParameterDescription
Investigation IDThe ID of the investigation to get details on.

Example Output

{
	"alert": {
		"alert_type": "string",
		"assets": {},
		"coalesce_key": "string",
		"create_time": "date-time",
		"created_at": "date-time",
		"direct_source_label": "string",
		"enrich_result": {},
		"entities": [
			{
				"type": "string",
				"value": "string"
			}
		],
		"handler_version": "* `v1` - v1\n* `v2` - v2",
		"id": 0,
		"origin_integration": "string",
		"origin_integration_display_name": "string",
		"origin_ticket_id": "string",
		"origin_ticket_id_label": "string",
		"origin_ticket_url": "string",
		"original_title": "string",
		"proxy_source_label": "string",
		"raw_alert_content": "string",
		"schema_key": "string",
		"severity": "string",
		"start_time": "date-time",
		"tenant_id": "string",
		"tenant_integration_key": "string",
		"tenant_label": "string",
		"title": "string",
		"updated_at": "date-time"
	},
	"alert_summary": "string",
	"attack_surface": "string",
	"backfill": 0,
	"canceled": "* `CANCEL_MANUAL` - CANCEL_MANUAL\n* `CANCEL_THRESHOLD` - CANCEL_THRESHOLD",
	"conclusion": "string",
	"conclusion_summary": "string",
	"created_at": "date-time",
	"error_msg": "string",
	"exec_summary": "string",
	"findings": [
		{
			"artifacts": [
				"string"
			],
			"evidences": [
				{
					"data": "string",
					"evidence_type": "string",
					"tag": "string"
				}
			],
			"finding": "string",
			"headline": "string",
			"outcome": "string"
		}
	],
	"findings_ranking": {},
	"generated_time": "date-time",
	"id": 0,
	"insight_tags": {},
	"interview_proposals": {},
	"inv_url": "string",
	"is_retried": false,
	"key_findings": {},
	"mitre_tactic": "string",
	"outcome": "* `COMPLETED_BREACHED_CONFIRMED` - COMPLETED_BREACHED_CONFIRMED\n* `COMPLETED_BREACHED_SUSPICIOUS` - COMPLETED_BREACHED_SUSPICIOUS\n* `COMPLETED_FALSE_ALERT` - COMPLETED_FALSE_ALERT\n* `INCOMPLETE` - INCOMPLETE\n* `IGNORED` - IGNORED",
	"priority": "* `informational` - Informational\n* `notable` - Notable\n* `urgent` - Urgent",
	"recommended_remediations": [
		"string"
	],
	"related_alert_hypothesis": {},
	"start_time": "date-time",
	"status": "* `not_asked` - not_asked\n* `loading` - loading\n* `success` - success\n* `error` - error",
	"updated_at": "date-time"
}

Workflow Library Example

Get Investigation with Dropzone AI and Send Results Via Email
Workflow LibraryPreview this Workflow on desktop