> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xdr-5-api/forensics/models.md).

# Models

## The InvestigationId object

```json
{"openapi":"3.0.2","info":{"title":"Cortex XDR Forensics REST API","version":"5.x"},"components":{"schemas":{"InvestigationId":{"type":"string","format":"uuid","description":"UUID v4 identifier of a forensic investigation."}}}}
```

## The CollectionId object

```json
{"openapi":"3.0.2","info":{"title":"Cortex XDR Forensics REST API","version":"5.x"},"components":{"schemas":{"CollectionId":{"type":"string","format":"uuid","description":"UUID v4 identifier of a hunt or triage collection."}}}}
```

## The AgentId object

```json
{"openapi":"3.0.2","info":{"title":"Cortex XDR Forensics REST API","version":"5.x"},"components":{"schemas":{"AgentId":{"type":"string","format":"uuid","description":"UUID v4 identifier of an endpoint agent."}}}}
```

## The SearchId object

```json
{"openapi":"3.0.2","info":{"title":"Cortex XDR Forensics REST API","version":"5.x"},"components":{"schemas":{"SearchId":{"type":"string","format":"uuid","description":"UUID v4 identifier of a hunt search."}}}}
```

## The ArtifactType object

```json
{"openapi":"3.0.2","info":{"title":"Cortex XDR Forensics REST API","version":"5.x"},"components":{"schemas":{"ArtifactType":{"type":"string","minLength":1,"description":"Name of the forensic artifact (table) to query. Must be a known artifact type registered in the forensic artifacts engine (for example `REGISTRY`, `AMCACHE`, `CHROME_HISTORY`, `MFT`, `EVTX`, `SHIMCACHE`)."}}}}
```

## The SearchFrom object

```json
{"openapi":"3.0.2","info":{"title":"Cortex XDR Forensics REST API","version":"5.x"},"components":{"schemas":{"SearchFrom":{"type":"integer","minimum":0,"default":0,"description":"Zero-based start index for pagination."}}}}
```

## The SearchTo object

```json
{"openapi":"3.0.2","info":{"title":"Cortex XDR Forensics REST API","version":"5.x"},"components":{"schemas":{"SearchTo":{"type":"integer","minimum":0,"description":"Exclusive end index for pagination. Defaults to `search_from + 1000`. The page window (`search_to - search_from`) must be `<= 1000` to prevent query timeouts and ensure optimal performance."}}}}
```

## The Investigation object

```json
{"openapi":"3.0.2","info":{"title":"Cortex XDR Forensics REST API","version":"5.x"},"components":{"schemas":{"Investigation":{"type":"object","properties":{"id":{"type":"string","format":"uuid"},"created_at":{"type":"string","format":"date-time"},"updated_at":{"type":"string","format":"date-time"},"created_by":{"type":"string","description":"Email or identifier of the user that created the investigation."},"updated_by":{"type":"string","description":"Email or identifier of the user that last updated the investigation."},"name":{"type":"string"},"description":{"type":"string"},"status":{"type":"string","enum":["open","close_pending"]},"expires_at":{"type":"string","format":"date-time","nullable":true},"total_collections":{"type":"integer","nullable":true},"completed_collections":{"type":"integer","nullable":true}}}}}}
```

## The HuntCollection object

```json
{"openapi":"3.0.2","info":{"title":"Cortex XDR Forensics REST API","version":"5.x"},"components":{"schemas":{"HuntCollection":{"type":"object","properties":{"id":{"type":"string","format":"uuid"},"type":{"type":"string","enum":["hunt"]},"investigation_id":{"type":"string","format":"uuid"},"name":{"type":"string"},"os":{"type":"string","description":"Operating system the collection targets (for example `WINDOWS`, `LINUX`, `MACOS`)."},"last_received_at":{"type":"integer","description":"Epoch-millisecond timestamp of the most recent result received for the collection."},"status":{"type":"string","nullable":true},"total_searches":{"type":"integer"},"searches":{"type":"array","items":{"type":"string","format":"uuid"},"description":"Identifiers of the hunt searches belonging to this collection."}}}}}}
```

## The TriageCollection object

```json
{"openapi":"3.0.2","info":{"title":"Cortex XDR Forensics REST API","version":"5.x"},"components":{"schemas":{"TriageCollection":{"type":"object","properties":{"id":{"type":"string","format":"uuid"},"type":{"type":"string","enum":["triage"]},"investigation_id":{"type":"string","format":"uuid"},"name":{"type":"string"},"os":{"type":"string"},"last_received_at":{"type":"integer","description":"Epoch-millisecond timestamp of the most recent result received for the collection."},"status":{"type":"string","nullable":true},"total_agents":{"type":"integer"},"agents":{"type":"array","items":{"type":"string","format":"uuid"},"description":"Identifiers of the agents that contributed data to this collection."}}}}}}
```

## The CollectionsByType object

```json
{"openapi":"3.0.2","info":{"title":"Cortex XDR Forensics REST API","version":"5.x"},"components":{"schemas":{"CollectionsByType":{"type":"object","properties":{"hunts":{"type":"array","items":{"$ref":"#/components/schemas/HuntCollection"}},"triages":{"type":"array","items":{"$ref":"#/components/schemas/TriageCollection"}}}},"HuntCollection":{"type":"object","properties":{"id":{"type":"string","format":"uuid"},"type":{"type":"string","enum":["hunt"]},"investigation_id":{"type":"string","format":"uuid"},"name":{"type":"string"},"os":{"type":"string","description":"Operating system the collection targets (for example `WINDOWS`, `LINUX`, `MACOS`)."},"last_received_at":{"type":"integer","description":"Epoch-millisecond timestamp of the most recent result received for the collection."},"status":{"type":"string","nullable":true},"total_searches":{"type":"integer"},"searches":{"type":"array","items":{"type":"string","format":"uuid"},"description":"Identifiers of the hunt searches belonging to this collection."}}},"TriageCollection":{"type":"object","properties":{"id":{"type":"string","format":"uuid"},"type":{"type":"string","enum":["triage"]},"investigation_id":{"type":"string","format":"uuid"},"name":{"type":"string"},"os":{"type":"string"},"last_received_at":{"type":"integer","description":"Epoch-millisecond timestamp of the most recent result received for the collection."},"status":{"type":"string","nullable":true},"total_agents":{"type":"integer"},"agents":{"type":"array","items":{"type":"string","format":"uuid"},"description":"Identifiers of the agents that contributed data to this collection."}}}}}}
```

## The HuntResult object

```json
{"openapi":"3.0.2","info":{"title":"Cortex XDR Forensics REST API","version":"5.x"},"components":{"schemas":{"HuntResult":{"type":"object","properties":{"id":{"type":"string","format":"uuid"},"created_at":{"type":"string","format":"date-time"},"category":{"type":"string","description":"Logical category of the artifact returned by the search."},"artifact_type":{"type":"string","description":"Public name of the forensic artifact table that holds the result rows. Use this value as `artifact_type` when calling `/get_data`."},"filters":{"type":"object","description":"Search parameters that were applied to produce the result.","additionalProperties":true},"status":{"type":"string"},"total_results":{"type":"integer"}}}}}}
```

## The TriageDataArtifactSummary object

```json
{"openapi":"3.0.2","info":{"title":"Cortex XDR Forensics REST API","version":"5.x"},"components":{"schemas":{"TriageDataArtifactSummary":{"type":"object","properties":{"id":{"type":"string","format":"uuid"},"created_at":{"type":"integer","description":"Epoch-millisecond timestamp."},"artifact_type":{"type":"string"},"status":{"type":"string","description":"Normalised upper-case status (for example `COMPLETED`, `FAILED`)."},"total_results":{"type":"integer"}}}}}}
```

## The TriageFileArtifactSummary object

```json
{"openapi":"3.0.2","info":{"title":"Cortex XDR Forensics REST API","version":"5.x"},"components":{"schemas":{"TriageFileArtifactSummary":{"type":"object","properties":{"id":{"type":"string","format":"uuid"},"created_at":{"type":"integer","description":"Epoch-millisecond timestamp."},"artifact_type":{"type":"string"},"status":{"type":"string"},"successful_file_paths":{"type":"array","items":{"type":"string"},"description":"File paths that were collected successfully. Populated only when the artifact succeeded."},"failed_file_paths":{"type":"array","items":{"type":"string"},"description":"File paths that the agent failed to collect. Populated when the artifact did not succeed."},"total_files":{"type":"integer"},"total_results":{"type":"integer"}}}}}}
```

## The TriageResultsByType object

```json
{"openapi":"3.0.2","info":{"title":"Cortex XDR Forensics REST API","version":"5.x"},"components":{"schemas":{"TriageResultsByType":{"type":"object","properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/TriageDataArtifactSummary"}},"files":{"type":"array","items":{"$ref":"#/components/schemas/TriageFileArtifactSummary"}}}},"TriageDataArtifactSummary":{"type":"object","properties":{"id":{"type":"string","format":"uuid"},"created_at":{"type":"integer","description":"Epoch-millisecond timestamp."},"artifact_type":{"type":"string"},"status":{"type":"string","description":"Normalised upper-case status (for example `COMPLETED`, `FAILED`)."},"total_results":{"type":"integer"}}},"TriageFileArtifactSummary":{"type":"object","properties":{"id":{"type":"string","format":"uuid"},"created_at":{"type":"integer","description":"Epoch-millisecond timestamp."},"artifact_type":{"type":"string"},"status":{"type":"string"},"successful_file_paths":{"type":"array","items":{"type":"string"},"description":"File paths that were collected successfully. Populated only when the artifact succeeded."},"failed_file_paths":{"type":"array","items":{"type":"string"},"description":"File paths that the agent failed to collect. Populated when the artifact did not succeed."},"total_files":{"type":"integer"},"total_results":{"type":"integer"}}}}}}
```

## The HostTimelineRow object

```json
{"openapi":"3.0.2","info":{"title":"Cortex XDR Forensics REST API","version":"5.x"},"components":{"schemas":{"HostTimelineRow":{"type":"object","properties":{"uuid":{"type":"string","format":"uuid"},"agent_id":{"type":"string","format":"uuid"},"timeline_id":{"type":"string"},"host_name":{"type":"string"},"generated_time":{"type":"integer","description":"Epoch-millisecond timestamp at which the row was generated by the agent."},"timestamp":{"type":"integer","description":"Epoch-millisecond timestamp of the event itself."},"timestamp_partition":{"type":"integer","description":"Date partition (YYYYMMDD) the row belongs to."},"description":{"type":"string"},"type":{"type":"string","description":"Event type (for example `PROCESS`, `FILE`, `REGISTRY`)."},"user":{"type":"string"},"data":{"type":"object","description":"Event-type-specific payload.","additionalProperties":true},"tags":{"type":"array","items":{"type":"string"}},"source_row_uuid":{"type":"string","format":"uuid"},"os":{"type":"string"}}}}}}
```

## The TriageCollectedFile object

```json
{"openapi":"3.0.2","info":{"title":"Cortex XDR Forensics REST API","version":"5.x"},"components":{"schemas":{"TriageCollectedFile":{"type":"object","properties":{"id":{"type":"string","format":"uuid","description":"Identifier of the parent triage-result row."},"file_path":{"type":"string"},"time_collected":{"type":"integer","description":"Epoch-millisecond timestamp at which the file was collected."},"available_for_download":{"type":"boolean"},"download_url":{"type":"string","format":"uri","nullable":true,"description":"Time-limited signed URL to download the file. Populated only when `available_for_download` is `true`."}}}}}}
```

## The InvestigationsResponse object

```json
{"openapi":"3.0.2","info":{"title":"Cortex XDR Forensics REST API","version":"5.x"},"components":{"schemas":{"InvestigationsResponse":{"type":"object","properties":{"reply":{"type":"object","properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/Investigation"}},"total_count":{"type":"integer"}}}}},"Investigation":{"type":"object","properties":{"id":{"type":"string","format":"uuid"},"created_at":{"type":"string","format":"date-time"},"updated_at":{"type":"string","format":"date-time"},"created_by":{"type":"string","description":"Email or identifier of the user that created the investigation."},"updated_by":{"type":"string","description":"Email or identifier of the user that last updated the investigation."},"name":{"type":"string"},"description":{"type":"string"},"status":{"type":"string","enum":["open","close_pending"]},"expires_at":{"type":"string","format":"date-time","nullable":true},"total_collections":{"type":"integer","nullable":true},"completed_collections":{"type":"integer","nullable":true}}}}}}
```

## The CollectionsResponse object

```json
{"openapi":"3.0.2","info":{"title":"Cortex XDR Forensics REST API","version":"5.x"},"components":{"schemas":{"CollectionsResponse":{"type":"object","properties":{"reply":{"type":"object","properties":{"data":{"$ref":"#/components/schemas/CollectionsByType"},"total_count":{"type":"integer"}}}}},"CollectionsByType":{"type":"object","properties":{"hunts":{"type":"array","items":{"$ref":"#/components/schemas/HuntCollection"}},"triages":{"type":"array","items":{"$ref":"#/components/schemas/TriageCollection"}}}},"HuntCollection":{"type":"object","properties":{"id":{"type":"string","format":"uuid"},"type":{"type":"string","enum":["hunt"]},"investigation_id":{"type":"string","format":"uuid"},"name":{"type":"string"},"os":{"type":"string","description":"Operating system the collection targets (for example `WINDOWS`, `LINUX`, `MACOS`)."},"last_received_at":{"type":"integer","description":"Epoch-millisecond timestamp of the most recent result received for the collection."},"status":{"type":"string","nullable":true},"total_searches":{"type":"integer"},"searches":{"type":"array","items":{"type":"string","format":"uuid"},"description":"Identifiers of the hunt searches belonging to this collection."}}},"TriageCollection":{"type":"object","properties":{"id":{"type":"string","format":"uuid"},"type":{"type":"string","enum":["triage"]},"investigation_id":{"type":"string","format":"uuid"},"name":{"type":"string"},"os":{"type":"string"},"last_received_at":{"type":"integer","description":"Epoch-millisecond timestamp of the most recent result received for the collection."},"status":{"type":"string","nullable":true},"total_agents":{"type":"integer"},"agents":{"type":"array","items":{"type":"string","format":"uuid"},"description":"Identifiers of the agents that contributed data to this collection."}}}}}}
```

## The HuntResultsResponse object

```json
{"openapi":"3.0.2","info":{"title":"Cortex XDR Forensics REST API","version":"5.x"},"components":{"schemas":{"HuntResultsResponse":{"type":"object","properties":{"reply":{"type":"object","properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/HuntResult"}},"total_count":{"type":"integer"}}}}},"HuntResult":{"type":"object","properties":{"id":{"type":"string","format":"uuid"},"created_at":{"type":"string","format":"date-time"},"category":{"type":"string","description":"Logical category of the artifact returned by the search."},"artifact_type":{"type":"string","description":"Public name of the forensic artifact table that holds the result rows. Use this value as `artifact_type` when calling `/get_data`."},"filters":{"type":"object","description":"Search parameters that were applied to produce the result.","additionalProperties":true},"status":{"type":"string"},"total_results":{"type":"integer"}}}}}}
```

## The TriageResultsResponse object

```json
{"openapi":"3.0.2","info":{"title":"Cortex XDR Forensics REST API","version":"5.x"},"components":{"schemas":{"TriageResultsResponse":{"type":"object","properties":{"reply":{"type":"object","properties":{"data":{"$ref":"#/components/schemas/TriageResultsByType"},"total_count":{"type":"integer"}}}}},"TriageResultsByType":{"type":"object","properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/TriageDataArtifactSummary"}},"files":{"type":"array","items":{"$ref":"#/components/schemas/TriageFileArtifactSummary"}}}},"TriageDataArtifactSummary":{"type":"object","properties":{"id":{"type":"string","format":"uuid"},"created_at":{"type":"integer","description":"Epoch-millisecond timestamp."},"artifact_type":{"type":"string"},"status":{"type":"string","description":"Normalised upper-case status (for example `COMPLETED`, `FAILED`)."},"total_results":{"type":"integer"}}},"TriageFileArtifactSummary":{"type":"object","properties":{"id":{"type":"string","format":"uuid"},"created_at":{"type":"integer","description":"Epoch-millisecond timestamp."},"artifact_type":{"type":"string"},"status":{"type":"string"},"successful_file_paths":{"type":"array","items":{"type":"string"},"description":"File paths that were collected successfully. Populated only when the artifact succeeded."},"failed_file_paths":{"type":"array","items":{"type":"string"},"description":"File paths that the agent failed to collect. Populated when the artifact did not succeed."},"total_files":{"type":"integer"},"total_results":{"type":"integer"}}}}}}
```

## The RawRowsResponse object

```json
{"openapi":"3.0.2","info":{"title":"Cortex XDR Forensics REST API","version":"5.x"},"components":{"schemas":{"RawRowsResponse":{"type":"object","properties":{"reply":{"type":"object","properties":{"data":{"type":"array","items":{"type":"object","additionalProperties":true,"description":"Artifact row whose shape depends on `artifact_type`."}},"total_count":{"type":"integer"}}}}}}}}
```

## The HostTimelineResponse object

```json
{"openapi":"3.0.2","info":{"title":"Cortex XDR Forensics REST API","version":"5.x"},"components":{"schemas":{"HostTimelineResponse":{"type":"object","properties":{"reply":{"type":"object","properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/HostTimelineRow"}},"total_count":{"type":"integer"}}}}},"HostTimelineRow":{"type":"object","properties":{"uuid":{"type":"string","format":"uuid"},"agent_id":{"type":"string","format":"uuid"},"timeline_id":{"type":"string"},"host_name":{"type":"string"},"generated_time":{"type":"integer","description":"Epoch-millisecond timestamp at which the row was generated by the agent."},"timestamp":{"type":"integer","description":"Epoch-millisecond timestamp of the event itself."},"timestamp_partition":{"type":"integer","description":"Date partition (YYYYMMDD) the row belongs to."},"description":{"type":"string"},"type":{"type":"string","description":"Event type (for example `PROCESS`, `FILE`, `REGISTRY`)."},"user":{"type":"string"},"data":{"type":"object","description":"Event-type-specific payload.","additionalProperties":true},"tags":{"type":"array","items":{"type":"string"}},"source_row_uuid":{"type":"string","format":"uuid"},"os":{"type":"string"}}}}}}
```

## The TriageFilesResponse object

```json
{"openapi":"3.0.2","info":{"title":"Cortex XDR Forensics REST API","version":"5.x"},"components":{"schemas":{"TriageFilesResponse":{"type":"object","properties":{"reply":{"type":"object","properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/TriageCollectedFile"}},"total_count":{"type":"integer"}}}}},"TriageCollectedFile":{"type":"object","properties":{"id":{"type":"string","format":"uuid","description":"Identifier of the parent triage-result row."},"file_path":{"type":"string"},"time_collected":{"type":"integer","description":"Epoch-millisecond timestamp at which the file was collected."},"available_for_download":{"type":"boolean"},"download_url":{"type":"string","format":"uri","nullable":true,"description":"Time-limited signed URL to download the file. Populated only when `available_for_download` is `true`."}}}}}}
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://cortex-docs.paloaltonetworks.com/xdr-5-api/forensics/models.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.