Parameter | Description |
---|---|
Investigation ID | The ID of the investigation to get details on. |
{
"alert": {
"alert_type": "string",
"assets": {},
"coalesce_key": "string",
"create_time": "date-time",
"created_at": "date-time",
"direct_source_label": "string",
"enrich_result": {},
"entities": [
{
"type": "string",
"value": "string"
}
],
"handler_version": "* `v1` - v1\n* `v2` - v2",
"id": 0,
"origin_integration": "string",
"origin_integration_display_name": "string",
"origin_ticket_id": "string",
"origin_ticket_id_label": "string",
"origin_ticket_url": "string",
"original_title": "string",
"proxy_source_label": "string",
"raw_alert_content": "string",
"schema_key": "string",
"severity": "string",
"start_time": "date-time",
"tenant_id": "string",
"tenant_integration_key": "string",
"tenant_label": "string",
"title": "string",
"updated_at": "date-time"
},
"alert_summary": "string",
"attack_surface": "string",
"backfill": 0,
"canceled": "* `CANCEL_MANUAL` - CANCEL_MANUAL\n* `CANCEL_THRESHOLD` - CANCEL_THRESHOLD",
"conclusion": "string",
"conclusion_summary": "string",
"created_at": "date-time",
"error_msg": "string",
"exec_summary": "string",
"findings": [
{
"artifacts": [
"string"
],
"evidences": [
{
"data": "string",
"evidence_type": "string",
"tag": "string"
}
],
"finding": "string",
"headline": "string",
"outcome": "string"
}
],
"findings_ranking": {},
"generated_time": "date-time",
"id": 0,
"insight_tags": {},
"interview_proposals": {},
"inv_url": "string",
"is_retried": false,
"key_findings": {},
"mitre_tactic": "string",
"outcome": "* `COMPLETED_BREACHED_CONFIRMED` - COMPLETED_BREACHED_CONFIRMED\n* `COMPLETED_BREACHED_SUSPICIOUS` - COMPLETED_BREACHED_SUSPICIOUS\n* `COMPLETED_FALSE_ALERT` - COMPLETED_FALSE_ALERT\n* `INCOMPLETE` - INCOMPLETE\n* `IGNORED` - IGNORED",
"priority": "* `informational` - Informational\n* `notable` - Notable\n* `urgent` - Urgent",
"recommended_remediations": [
"string"
],
"related_alert_hypothesis": {},
"start_time": "date-time",
"status": "* `not_asked` - not_asked\n* `loading` - loading\n* `success` - success\n* `error` - error",
"updated_at": "date-time"
}
Was this page helpful?