Get Investigation - BlinkOps Documentation

Get investigation details by its ID.

External DocumentationTo learn more, visit the Rapid7 InsightIDR documentation.

Parameters

Parameter	Description
Investigation ID	The ID of the investigation to get details on.
Multi Customer	When selected, investigations will be returned from all organizations the connected user has access to. Note: This feature is available for multi-customer user keys only.

Example Output

{
	"rrn": "rrn:investigation:us1:174e4f99-2ac7-4481-9301-4d24c34baf06:investigation:6A74T2A4",
	"organization_id": "174e4f99-2ac7-4481-9301-4d24c34baf06",
	"title": "Jane Smith enabled account Roger Johnson",
	"source": "ALERT",
	"status": "OPEN",
	"priority": "CRITICAL",
	"last_accessed": "2018-06-06T16:56:42Z",
	"created_time": "2018-06-06T16:56:42Z",
	"disposition": "BENIGN",
	"assignee": {
		"name": "Ellen Example",
		"email": "example@test.com"
	},
	"first_alert_time": "2018-06-06T16:56:42Z",
	"latest_alert_time": "2018-06-06T16:56:42Z",
	"tags": [
		"Incident",
		"Security Test"
	],
	"responsibility": "CUSTOMER"
}

Workflow Library Example

Get Investigation with Rapid7 Insightidr and Send Results Via Email

Preview this Workflow on desktop