> ## Documentation Index
> Fetch the complete documentation index at: https://docs.blinkops.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Add Evidence To Investigation

Add alerts, events and saved searches as evidence to an existing investigation.

<Note>
  External Documentation

  To learn more, visit the [Secureworks Taegis XDR documentation](https://docs.taegis.secureworks.com/apis/using_investigations_api/#add-additional-evidence-to-an-investigation).
</Note>

## Parameters

<div className="integrations-table">
  | Parameter           | Description                                                                                                                                                                                                                                       |
  | ------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
  | Alerts              | A comma-separated list of alert IDs to attach to the investigation. Can be obtained using the `Search Alerts` action.<br /><br />**For Example:** `alert://priv:stolen-user-credentials:11772:1723482198701:9640c014-cd59-448d-b47d-aa8e8e3747fe` |
  | Alerts Search Query | A CQL query used to add alerts to the investigation in bulk.<br /><br />**For Example:** `FROM alert WHERE severity >= 0.6 AND status = 'OPEN' EARLIEST=-1d`                                                                                      |
  | Events              | A comma-separated list of event IDs to attach to the investigation.<br /><br />**For Example:** `event://priv:scwx.auth:11772:1708626661995:422496f6-a491-4983-af90-020a4b46a0e8`                                                                 |
  | Investigation ID    | The ID of the investigation to add the evidence to. Can be obtained using the `Search Investigations` action.<br /><br />**For Example:** `d638e49d-a3b5-421e-b28d-cb9322a5eaa6`                                                                  |
  | Search Queries      | A comma-separated list of saved searches to attach to the investigation. The searches themselves are attached, not their results.                                                                                                                 |
</div>

## Workflow Library Example

[Add Evidence to Investigation with Secureworks Taegis Xdr and Send Results Via Email](https://library.blinkops.com/workflows/add-evidence-to-investigation-with-secureworks-taegis-xdr-and-send-results-via-email)

<div className="iframe-wrapper">
  <div className="iframe-media">
    <img src="https://mintcdn.com/blinkops-2/ojHYuDeYX5FWuN8a/img/Icons/play-box.svg?fit=max&auto=format&n=ojHYuDeYX5FWuN8a&q=85&s=b8af968e71438a9499c3223c9bd29fb2" alt="Workflow Library" width="16" height="16" data-path="img/Icons/play-box.svg" />

    Preview this Workflow on desktop
  </div>

  <iframe className="iframe" src="https://library.blinkops.com/workflows/add-evidence-to-investigation-with-secureworks-taegis-xdr-and-send-results-via-email/canvas" />
</div>