External DocumentationTo learn more, visit the Expel documentation.
Parameters
| Parameter | Description |
|---|---|
| Filter | Filters the results based on the given expression. The syntax of a filter expression filter[<field>]=<operator><value>.For example: filter[created_at]=>2020-01-01T00:00:00Z equals to created_at > 2020-01-01T00:00:00Z.For further information regarding filtering resources, please refer to Expel Documentation. |
| Limit | The maximum amount of results to be returned. The limit may be set to 0. This is useful if your api client needs a count of records without needing to retrieve the actual content of those records. |
| Offset | The offset of the pagination. Specifies the starting index of the results to be returned. |
| Sort | Sorts the results by a particular attribute. |
Example Output
{
"links": {
"self": " https://workbench.expel.io/api/v2/investigations"
},
"data": [
{
"analyst_severity": "CRITICAL",
"attack_lifecycle": "INITIAL_RECON",
"attack_timing": "HISTORICAL",
"attack_vector": "DRIVE_BY",
"close_comment": "string",
"created_at": "2019-01-15T15:35:00-05:00",
"critical_comment": "string",
"decision": "FALSE_POSITIVE",
"default_plugin_slug": "string",
"deleted_at": "2019-01-15T15:35:00-05:00",
"detection_type": "UNKNOWN",
"has_hunting_status": true,
"initial_attack_vector": "string",
"is_downgrade": true,
"is_incident": true,
"is_incident_status_updated_at": "2019-01-15T15:35:00-05:00",
"is_soc_support_required": true,
"is_surge": true,
"last_published_at": "2019-01-15T15:35:00-05:00",
"last_published_value": "string",
"lead_description": "string",
"malware_family": "string",
"next_steps": "string",
"open_reason": "ACCESS_KEYS",
"open_summary": "string",
"review_requested_at": "2019-01-15T15:35:00-05:00",
"short_link": "string",
"source_reason": "HUNTING",
"status_updated_at": "2019-01-15T15:35:00-05:00",
"threat_type": "TARGETED",
"title": "string",
"updated_at": "2019-01-15T15:35:00-05:00"
}
]
}
Workflow Library Example
List Investigations with Expel and Send Results Via Email