> ## Documentation Index
> Fetch the complete documentation index at: https://docs.blinkops.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Close Multiple Investigations

Close all the investigations that match the filtering criteria.

**Note:** One of the following parameters is required - `Alert Type`, `Detection Rule RRN`.

<Note>
  External Documentation

  To learn more, visit the [Rapid7 InsightIDR documentation](https://help.rapid7.com/insightidr/en-us/api/v2/docs.html#tag/Investigations/operation/bulkCloseInvestigations).
</Note>

## Parameters

<div className="integrations-table">
  | Parameter                   | Description                                                                                                                                                                   |
  | --------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
  | Alert Type                  | The type of the alert that should be closed. For example - `Attacker Behavior Detected`.<br /><br />**Note:** This parameter is required when closing `ALERT` investigations. |
  | Detection Rule RRN          | The RRN of the detection rule. <br /><br />**Note:** Using this parameter requires `Alert Type` to be set to `Attacker Behavior Detected`.                                    |
  | Disposition                 | A disposition to set the investigation to. Defaults to `NOT_APPLICABLE`.                                                                                                      |
  | From                        | A starting timeframe to close investigations created after it.                                                                                                                |
  | Max Investigations To Close | The maximum number of investigations to close.<br /><br />**Note:** If this limit is exceeded - status code `400` will be returned.                                           |
  | Source                      | The source of an investigations to close.                                                                                                                                     |
  | To                          | An ending timeframe to close investigations created after it.                                                                                                                 |
</div>

## Example Output

```json theme={"dark"}
{
	"ids": [
		"581134c9-2510-4010-865c-7ae81761315b",
		"114c706d-e64a-4731-997b-9115beef3026"
	],
	"num_closed": 2
}
```

## Workflow Library Example

[Close Multiple Investigations with Rapid7 Insightidr and Send Results Via Email](https://library.blinkops.com/workflows/close-multiple-investigations-with-rapid7-insightidr-and-send-results-via-email)

<div className="iframe-wrapper">
  <div className="iframe-media">
    <img src="https://mintcdn.com/blinkops-2/ojHYuDeYX5FWuN8a/img/Icons/play-box.svg?fit=max&auto=format&n=ojHYuDeYX5FWuN8a&q=85&s=b8af968e71438a9499c3223c9bd29fb2" alt="Workflow Library" width="16" height="16" data-path="img/Icons/play-box.svg" />

    Preview this Workflow on desktop
  </div>

  <iframe className="iframe" src="https://library.blinkops.com/workflows/close-multiple-investigations-with-rapid7-insightidr-and-send-results-via-email/canvas" />
</div>