Create Investigation - BlinkOps Documentation

Create a new investigation, optionally attaching alerts, events and saved searches to it as genesis evidence.

External DocumentationTo learn more, visit the Secureworks Taegis XDR documentation.

Parameters

Parameter	Description
Alerts	A comma-separated list of alert IDs to attach to the investigation. Can be obtained using the `Search Alerts` action. Note: Alerts attached on creation are considered genesis evidence.
Alerts Search Query	A CQL query used to attach alerts to the investigation in bulk. For Example: `FROM alert WHERE severity >= 0.6 AND status = 'OPEN' EARLIEST=-1d`f.
Assignee ID	The user to assign the investigation to. Must be a valid user ID, client ID or `@mention`. For Example: `@customer` or `@secureworks`
Events	A comma-separated list of event IDs to attach to the investigation.
Key Findings	The key findings explaining the details of the investigation.
Priority	Select the priority of the investigation.
Search Queries	A comma-separated list of saved searches to attach to the investigation. The searches themselves are attached, not their results.
Service Desk ID	An ID mapping a third-party service desk ticket to the investigation. May be a URL or any other identifier. For Example: `https://company.service-now.com//nav_to.do?uri=%2Fincident.do%3Fsys_id=3454676eadfedaf8e665370cbb350b&id=INC2345`
Service Desk Type	The service desk type used in relation to the `Service Desk ID`. Free form text that is not validated. For Example: `SNOW`
Status	Select the status of the investigation.
Tags	A comma-separated list of tags used to help label the investigation.
Title	The title of the investigation. Limited to `256` characters, anything longer is trimmed.
Type	Select the type to open the investigation as. The available types depend on your user and your tenant’s service level.

Workflow Library Example

Create Investigation with Secureworks Taegis Xdr and Send Results Via Email

Preview this Workflow on desktop

⌘I