> ## Documentation Index
> Fetch the complete documentation index at: https://docs.blinkops.com/llms.txt
> Use this file to discover all available pages before exploring further.

# List Investigations

Get a list of investigations with optional filtering.

<Note>
  External Documentation

  To learn more, visit the [Rapid7 InsightIDR documentation](https://help.rapid7.com/insightidr/en-us/api/v2/docs.html#tag/Investigations/operation/listInvestigations).
</Note>

## Basic Parameters

<div className="integrations-table">
  | Parameter        | Description                                                                                                                                                                                               |
  | ---------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
  | End Time         | The end of the timeframe to filter the results by.                                                                                                                                                        |
  | Page             | The number of the page to return results from (zero-based).                                                                                                                                               |
  | Page Size        | The maximum number of results to return per page. Valid range is `1`-`1000`.                                                                                                                              |
  | Return All Pages | Automatically fetch all resources, page by page.                                                                                                                                                          |
  | Start Time       | The start of the timeframe to filter the results by.                                                                                                                                                      |
  | Statuses         | A comma-separated list of statuses of investigations to filter by.                                                                                                                                        |
  | Tags             | A comma-separated list of tags to include in the response. Only investigations who have all specified tags will be included.<br /><br />**For Example:** `Incident, Security Test, Reported to Customer`. |
</div>

## Advanced Parameters

<div className="integrations-table">
  | Parameter              | Description                                                                                                                                                                                                                                                                                                                                                                                                  |
  | ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
  | Assignee Email Address | The email address of the assignee to filter the results by.                                                                                                                                                                                                                                                                                                                                                  |
  | Multi Customer         | When selected, investigations will be returned from all organizations the connected user has access to. <br /><br />**Note**: This feature is available for multi-customer user keys only.                                                                                                                                                                                                                   |
  | Priorities             | A comma-separated list of investigation priorities to filter the results by. For Example - `UNSPECIFIED, LOW, MEDIUM, HIGH, CRITICAL`                                                                                                                                                                                                                                                                        |
  | Sort                   | An investigation field to filter the results by, concatenated with the direction of sorting.<br /><br />For Example: `priority,DESC`<br /><br />Available sorting parameters:<br />  - created\_time<br />  - priority<br />  - rrn<br />  - alerts\_most\_recent\_created\_time<br />  - alerts\_most\_recent\_detection\_created\_time<br /><br />Available sorting directions:<br />  - DESC<br />  - ASC |
  | Sources                | A comma-separated list of investigation sources to filter the results by. For Example - `USER,ALERT`                                                                                                                                                                                                                                                                                                         |
</div>

## Example Output

```json theme={"dark"}
{
	"data": [
		{
			"rrn": "rrn:investigation:us1:174e4f99-2ac7-4481-9301-4d24c34baf06:investigation:6A74T2A4",
			"organization_id": "174e4f99-2ac7-4481-9301-4d24c34baf06",
			"title": "Jane Smith enabled account Roger Johnson",
			"source": "ALERT",
			"status": "OPEN",
			"priority": "CRITICAL",
			"last_accessed": "2018-06-06T16:56:42Z",
			"created_time": "2018-06-06T16:56:42Z",
			"disposition": "BENIGN",
			"assignee": {
				"name": "Ellen Example",
				"email": "example@test.com"
			},
			"first_alert_time": "2018-06-06T16:56:42Z",
			"latest_alert_time": "2018-06-06T16:56:42Z",
			"tags": [
				"Incident",
				"Security Test"
			],
			"responsibility": "CUSTOMER"
		}
	],
	"metadata": {
		"index": 0,
		"size": 20,
		"total_pages": 1,
		"total_data": 15
	}
}
```

## Workflow Library Example

[List Investigations with Rapid7 Insightidr and Send Results Via Email](https://library.blinkops.com/workflows/list-investigations-with-rapid7-insightidr-and-send-results-via-email)

<div className="iframe-wrapper">
  <div className="iframe-media">
    <img src="https://mintcdn.com/blinkops-2/ojHYuDeYX5FWuN8a/img/Icons/play-box.svg?fit=max&auto=format&n=ojHYuDeYX5FWuN8a&q=85&s=b8af968e71438a9499c3223c9bd29fb2" alt="Workflow Library" width="16" height="16" data-path="img/Icons/play-box.svg" />

    Preview this Workflow on desktop
  </div>

  <iframe className="iframe" src="https://library.blinkops.com/workflows/list-investigations-with-rapid7-insightidr-and-send-results-via-email/canvas" />
</div>