> ## Documentation Index
> Fetch the complete documentation index at: https://docs.blinkops.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Create Investigation

Create a new investigation, optionally attaching alerts, events and saved searches to it as genesis evidence.

<Note>
  External Documentation

  To learn more, visit the [Secureworks Taegis XDR documentation](https://docs.taegis.secureworks.com/apis/using_investigations_api/#create-an-investigation).
</Note>

## Parameters

<div className="integrations-table">
  | Parameter           | Description                                                                                                                                                                                                                                                |
  | ------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
  | Alerts              | A comma-separated list of alert IDs to attach to the investigation. Can be obtained using the `Search Alerts` action.<br /><br />**Note:** Alerts attached on creation are considered genesis evidence.                                                    |
  | Alerts Search Query | A CQL query used to attach alerts to the investigation in bulk.<br /><br />**For Example:** `FROM alert WHERE severity >= 0.6 AND status = 'OPEN' EARLIEST=-1d`f.                                                                                          |
  | Assignee ID         | The user to assign the investigation to. Must be a valid user ID, client ID or `@mention`.<br /><br />**For Example:** `@customer` or `@secureworks`                                                                                                       |
  | Events              | A comma-separated list of event IDs to attach to the investigation.                                                                                                                                                                                        |
  | Key Findings        | The key findings explaining the details of the investigation.                                                                                                                                                                                              |
  | Priority            | Select the priority of the investigation.                                                                                                                                                                                                                  |
  | Search Queries      | A comma-separated list of saved searches to attach to the investigation. The searches themselves are attached, not their results.                                                                                                                          |
  | Service Desk ID     | An ID mapping a third-party service desk ticket to the investigation. May be a URL or any other identifier.<br /><br />**For Example:** `https://company.service-now.com//nav_to.do?uri=%2Fincident.do%3Fsys_id=3454676eadfedaf8e665370cbb350b&id=INC2345` |
  | Service Desk Type   | The service desk type used in relation to the `Service Desk ID`. Free form text that is not validated.<br /><br />**For Example:** `SNOW`                                                                                                                  |
  | Status              | Select the status of the investigation.                                                                                                                                                                                                                    |
  | Tags                | A comma-separated list of tags used to help label the investigation.                                                                                                                                                                                       |
  | Title               | The title of the investigation. Limited to `256` characters, anything longer is trimmed.                                                                                                                                                                   |
  | Type                | Select the type to open the investigation as. The available types depend on your user and your tenant's service level.                                                                                                                                     |
</div>

## Workflow Library Example

[Create Investigation with Secureworks Taegis Xdr and Send Results Via Email](https://library.blinkops.com/workflows/create-investigation-with-secureworks-taegis-xdr-and-send-results-via-email)

<div className="iframe-wrapper">
  <div className="iframe-media">
    <img src="https://mintcdn.com/blinkops-2/ojHYuDeYX5FWuN8a/img/Icons/play-box.svg?fit=max&auto=format&n=ojHYuDeYX5FWuN8a&q=85&s=b8af968e71438a9499c3223c9bd29fb2" alt="Workflow Library" width="16" height="16" data-path="img/Icons/play-box.svg" />

    Preview this Workflow on desktop
  </div>

  <iframe className="iframe" src="https://library.blinkops.com/workflows/create-investigation-with-secureworks-taegis-xdr-and-send-results-via-email/canvas" />
</div>