> ## Documentation Index
> Fetch the complete documentation index at: https://docs.blinkops.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Get Investigation

Retrieves an investigation using given ID.

<Note>
  External Documentation

  To learn more, visit the [Expel documentation](https://workbench.expel.io/api/v2/docs/#section/CRUD-operations/GET-:resource:id).
</Note>

## Parameters

<div className="integrations-table">
  | Parameter        | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
  | ---------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
  | Include          | A comma separated list of the relationship records to include in the response.<br /><br />For example: `organization,created_by,updated_by`.<br /><br />This is useful when you are querying for a record, and want to resolve specific relationship data without making multiple calls, such as `expel_alerts`. For further information, please refer to [Expel Documentation](https://workbench.expel.io/api/v2/docs/#section/Common-query-parameters/Includes). |
  | Investigation ID | The ID of the investigation to retrieve. Can be obtained using the `List Investigations` action.                                                                                                                                                                                                                                                                                                                                                                   |
</div>

## Example Output

```json theme={"dark"}
{
	"links": {
		"self": " https://workbench.expel.io/api/v2/investigations/exampleid"
	},
	"data": {
		"analyst_severity": "CRITICAL",
		"attack_lifecycle": "INITIAL_RECON",
		"attack_timing": "HISTORICAL",
		"attack_vector": "DRIVE_BY",
		"close_comment": "string",
		"created_at": "2019-01-15T15:35:00-05:00",
		"critical_comment": "string",
		"decision": "FALSE_POSITIVE",
		"default_plugin_slug": "string",
		"deleted_at": "2019-01-15T15:35:00-05:00",
		"detection_type": "UNKNOWN",
		"has_hunting_status": true,
		"initial_attack_vector": "string",
		"is_downgrade": true,
		"is_incident": true,
		"is_incident_status_updated_at": "2019-01-15T15:35:00-05:00",
		"is_soc_support_required": true,
		"is_surge": true,
		"last_published_at": "2019-01-15T15:35:00-05:00",
		"last_published_value": "string",
		"lead_description": "string",
		"malware_family": "string",
		"next_steps": "string",
		"open_reason": "ACCESS_KEYS",
		"open_summary": "string",
		"review_requested_at": "2019-01-15T15:35:00-05:00",
		"short_link": "string",
		"source_reason": "HUNTING",
		"status_updated_at": "2019-01-15T15:35:00-05:00",
		"threat_type": "TARGETED",
		"title": "string",
		"updated_at": "2019-01-15T15:35:00-05:00"
	}
}
```

## Workflow Library Example

[Get Investigation with Expel and Send Results Via Email](https://library.blinkops.com/workflows/get-investigation-with-expel-and-send-results-via-email)

<div className="iframe-wrapper">
  <div className="iframe-media">
    <img src="https://mintcdn.com/blinkops-2/ojHYuDeYX5FWuN8a/img/Icons/play-box.svg?fit=max&auto=format&n=ojHYuDeYX5FWuN8a&q=85&s=b8af968e71438a9499c3223c9bd29fb2" alt="Workflow Library" width="16" height="16" data-path="img/Icons/play-box.svg" />

    Preview this Workflow on desktop
  </div>

  <iframe className="iframe" src="https://library.blinkops.com/workflows/get-investigation-with-expel-and-send-results-via-email/canvas" />
</div>