Add Evidence To Investigation - BlinkOps Documentation

Add alerts, events and saved searches as evidence to an existing investigation.

External DocumentationTo learn more, visit the Secureworks Taegis XDR documentation.

Parameters

Parameter	Description
Alerts	A comma-separated list of alert IDs to attach to the investigation. Can be obtained using the `Search Alerts` action. For Example: `alert://priv:stolen-user-credentials:11772:1723482198701:9640c014-cd59-448d-b47d-aa8e8e3747fe`
Alerts Search Query	A CQL query used to add alerts to the investigation in bulk. For Example: `FROM alert WHERE severity >= 0.6 AND status = 'OPEN' EARLIEST=-1d`
Events	A comma-separated list of event IDs to attach to the investigation. For Example: `event://priv:scwx.auth:11772:1708626661995:422496f6-a491-4983-af90-020a4b46a0e8`
Investigation ID	The ID of the investigation to add the evidence to. Can be obtained using the `Search Investigations` action. For Example: `d638e49d-a3b5-421e-b28d-cb9322a5eaa6`
Search Queries	A comma-separated list of saved searches to attach to the investigation. The searches themselves are attached, not their results.

Workflow Library Example

Add Evidence to Investigation with Secureworks Taegis Xdr and Send Results Via Email

Preview this Workflow on desktop