> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xsiam-api/forensics/models.md).

# Models

## The InvestigationId object

```json
{"openapi":"3.0.2","info":{"title":"Cortex XSIAM Forensics REST API","version":"3.x"},"components":{"schemas":{"InvestigationId":{"type":"string","format":"uuid","description":"UUID v4 identifier of a forensic investigation."}}}}
```

## The CollectionId object

```json
{"openapi":"3.0.2","info":{"title":"Cortex XSIAM Forensics REST API","version":"3.x"},"components":{"schemas":{"CollectionId":{"type":"string","format":"uuid","description":"UUID v4 identifier of a hunt or triage collection."}}}}
```

## The AgentId object

```json
{"openapi":"3.0.2","info":{"title":"Cortex XSIAM Forensics REST API","version":"3.x"},"components":{"schemas":{"AgentId":{"type":"string","format":"uuid","description":"UUID v4 identifier of an endpoint agent."}}}}
```

## The SearchId object

```json
{"openapi":"3.0.2","info":{"title":"Cortex XSIAM Forensics REST API","version":"3.x"},"components":{"schemas":{"SearchId":{"type":"string","format":"uuid","description":"UUID v4 identifier of a hunt search."}}}}
```

## The ArtifactType object

```json
{"openapi":"3.0.2","info":{"title":"Cortex XSIAM Forensics REST API","version":"3.x"},"components":{"schemas":{"ArtifactType":{"type":"string","minLength":1,"description":"Name of the forensic artifact (table) to query. Must be a known artifact type registered in the forensic artifacts engine (for example `REGISTRY`, `AMCACHE`, `CHROME_HISTORY`, `MFT`, `EVTX`, `SHIMCACHE`)."}}}}
```

## The SearchFrom object

```json
{"openapi":"3.0.2","info":{"title":"Cortex XSIAM Forensics REST API","version":"3.x"},"components":{"schemas":{"SearchFrom":{"type":"integer","minimum":0,"default":0,"description":"Zero-based start index for pagination."}}}}
```

## The SearchTo object

```json
{"openapi":"3.0.2","info":{"title":"Cortex XSIAM Forensics REST API","version":"3.x"},"components":{"schemas":{"SearchTo":{"type":"integer","minimum":0,"description":"Exclusive end index for pagination. Defaults to `search_from + 1000`. The page window (`search_to - search_from`) must be `<= 1000` to prevent query timeouts and ensure optimal performance."}}}}
```

## The Investigation object

```json
{"openapi":"3.0.2","info":{"title":"Cortex XSIAM Forensics REST API","version":"3.x"},"components":{"schemas":{"Investigation":{"type":"object","properties":{"id":{"type":"string","format":"uuid"},"created_at":{"type":"string","format":"date-time"},"updated_at":{"type":"string","format":"date-time"},"created_by":{"type":"string","description":"Email or identifier of the user that created the investigation."},"updated_by":{"type":"string","description":"Email or identifier of the user that last updated the investigation."},"name":{"type":"string"},"description":{"type":"string"},"status":{"type":"string","enum":["open","close_pending"]},"expires_at":{"type":"string","format":"date-time","nullable":true},"total_collections":{"type":"integer","nullable":true},"completed_collections":{"type":"integer","nullable":true}}}}}}
```

## The HuntCollection object

```json
{"openapi":"3.0.2","info":{"title":"Cortex XSIAM Forensics REST API","version":"3.x"},"components":{"schemas":{"HuntCollection":{"type":"object","properties":{"id":{"type":"string","format":"uuid"},"type":{"type":"string","enum":["hunt"]},"investigation_id":{"type":"string","format":"uuid"},"name":{"type":"string"},"os":{"type":"string","description":"Operating system the collection targets (for example `WINDOWS`, `LINUX`, `MACOS`)."},"last_received_at":{"type":"integer","description":"Epoch-millisecond timestamp of the most recent result received for the collection."},"status":{"type":"string","nullable":true},"total_searches":{"type":"integer"},"searches":{"type":"array","items":{"type":"string","format":"uuid"},"description":"Identifiers of the hunt searches belonging to this collection."}}}}}}
```

## The TriageCollection object

```json
{"openapi":"3.0.2","info":{"title":"Cortex XSIAM Forensics REST API","version":"3.x"},"components":{"schemas":{"TriageCollection":{"type":"object","properties":{"id":{"type":"string","format":"uuid"},"type":{"type":"string","enum":["triage"]},"investigation_id":{"type":"string","format":"uuid"},"name":{"type":"string"},"os":{"type":"string"},"last_received_at":{"type":"integer","description":"Epoch-millisecond timestamp of the most recent result received for the collection."},"status":{"type":"string","nullable":true},"total_agents":{"type":"integer"},"agents":{"type":"array","items":{"type":"string","format":"uuid"},"description":"Identifiers of the agents that contributed data to this collection."}}}}}}
```

## The CollectionsByType object

```json
{"openapi":"3.0.2","info":{"title":"Cortex XSIAM Forensics REST API","version":"3.x"},"components":{"schemas":{"CollectionsByType":{"type":"object","properties":{"hunts":{"type":"array","items":{"$ref":"#/components/schemas/HuntCollection"}},"triages":{"type":"array","items":{"$ref":"#/components/schemas/TriageCollection"}}}},"HuntCollection":{"type":"object","properties":{"id":{"type":"string","format":"uuid"},"type":{"type":"string","enum":["hunt"]},"investigation_id":{"type":"string","format":"uuid"},"name":{"type":"string"},"os":{"type":"string","description":"Operating system the collection targets (for example `WINDOWS`, `LINUX`, `MACOS`)."},"last_received_at":{"type":"integer","description":"Epoch-millisecond timestamp of the most recent result received for the collection."},"status":{"type":"string","nullable":true},"total_searches":{"type":"integer"},"searches":{"type":"array","items":{"type":"string","format":"uuid"},"description":"Identifiers of the hunt searches belonging to this collection."}}},"TriageCollection":{"type":"object","properties":{"id":{"type":"string","format":"uuid"},"type":{"type":"string","enum":["triage"]},"investigation_id":{"type":"string","format":"uuid"},"name":{"type":"string"},"os":{"type":"string"},"last_received_at":{"type":"integer","description":"Epoch-millisecond timestamp of the most recent result received for the collection."},"status":{"type":"string","nullable":true},"total_agents":{"type":"integer"},"agents":{"type":"array","items":{"type":"string","format":"uuid"},"description":"Identifiers of the agents that contributed data to this collection."}}}}}}
```

## The HuntResult object

```json
{"openapi":"3.0.2","info":{"title":"Cortex XSIAM Forensics REST API","version":"3.x"},"components":{"schemas":{"HuntResult":{"type":"object","properties":{"id":{"type":"string","format":"uuid"},"created_at":{"type":"string","format":"date-time"},"category":{"type":"string","description":"Logical category of the artifact returned by the search."},"artifact_type":{"type":"string","description":"Public name of the forensic artifact table that holds the result rows. Use this value as `artifact_type` when calling `/get_data`."},"filters":{"type":"object","description":"Search parameters that were applied to produce the result.","additionalProperties":true},"status":{"type":"string"},"total_results":{"type":"integer"}}}}}}
```

## The TriageDataArtifactSummary object

```json
{"openapi":"3.0.2","info":{"title":"Cortex XSIAM Forensics REST API","version":"3.x"},"components":{"schemas":{"TriageDataArtifactSummary":{"type":"object","properties":{"id":{"type":"string","format":"uuid"},"created_at":{"type":"integer","description":"Epoch-millisecond timestamp."},"artifact_type":{"type":"string"},"status":{"type":"string","description":"Normalised upper-case status (for example `COMPLETED`, `FAILED`)."},"total_results":{"type":"integer"}}}}}}
```

## The TriageFileArtifactSummary object

```json
{"openapi":"3.0.2","info":{"title":"Cortex XSIAM Forensics REST API","version":"3.x"},"components":{"schemas":{"TriageFileArtifactSummary":{"type":"object","properties":{"id":{"type":"string","format":"uuid"},"created_at":{"type":"integer","description":"Epoch-millisecond timestamp."},"artifact_type":{"type":"string"},"status":{"type":"string"},"successful_file_paths":{"type":"array","items":{"type":"string"},"description":"File paths that were collected successfully. Populated only when the artifact succeeded."},"failed_file_paths":{"type":"array","items":{"type":"string"},"description":"File paths that the agent failed to collect. Populated when the artifact did not succeed."},"total_files":{"type":"integer"},"total_results":{"type":"integer"}}}}}}
```

## The TriageResultsByType object

```json
{"openapi":"3.0.2","info":{"title":"Cortex XSIAM Forensics REST API","version":"3.x"},"components":{"schemas":{"TriageResultsByType":{"type":"object","properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/TriageDataArtifactSummary"}},"files":{"type":"array","items":{"$ref":"#/components/schemas/TriageFileArtifactSummary"}}}},"TriageDataArtifactSummary":{"type":"object","properties":{"id":{"type":"string","format":"uuid"},"created_at":{"type":"integer","description":"Epoch-millisecond timestamp."},"artifact_type":{"type":"string"},"status":{"type":"string","description":"Normalised upper-case status (for example `COMPLETED`, `FAILED`)."},"total_results":{"type":"integer"}}},"TriageFileArtifactSummary":{"type":"object","properties":{"id":{"type":"string","format":"uuid"},"created_at":{"type":"integer","description":"Epoch-millisecond timestamp."},"artifact_type":{"type":"string"},"status":{"type":"string"},"successful_file_paths":{"type":"array","items":{"type":"string"},"description":"File paths that were collected successfully. Populated only when the artifact succeeded."},"failed_file_paths":{"type":"array","items":{"type":"string"},"description":"File paths that the agent failed to collect. Populated when the artifact did not succeed."},"total_files":{"type":"integer"},"total_results":{"type":"integer"}}}}}}
```

## The HostTimelineRow object

```json
{"openapi":"3.0.2","info":{"title":"Cortex XSIAM Forensics REST API","version":"3.x"},"components":{"schemas":{"HostTimelineRow":{"type":"object","properties":{"uuid":{"type":"string","format":"uuid"},"agent_id":{"type":"string","format":"uuid"},"timeline_id":{"type":"string"},"host_name":{"type":"string"},"generated_time":{"type":"integer","description":"Epoch-millisecond timestamp at which the row was generated by the agent."},"timestamp":{"type":"integer","description":"Epoch-millisecond timestamp of the event itself."},"timestamp_partition":{"type":"integer","description":"Date partition (YYYYMMDD) the row belongs to."},"description":{"type":"string"},"type":{"type":"string","description":"Event type (for example `PROCESS`, `FILE`, `REGISTRY`)."},"user":{"type":"string"},"data":{"type":"object","description":"Event-type-specific payload.","additionalProperties":true},"tags":{"type":"array","items":{"type":"string"}},"source_row_uuid":{"type":"string","format":"uuid"},"os":{"type":"string"}}}}}}
```

## The TriageCollectedFile object

```json
{"openapi":"3.0.2","info":{"title":"Cortex XSIAM Forensics REST API","version":"3.x"},"components":{"schemas":{"TriageCollectedFile":{"type":"object","properties":{"id":{"type":"string","format":"uuid","description":"Identifier of the parent triage-result row."},"file_path":{"type":"string"},"time_collected":{"type":"integer","description":"Epoch-millisecond timestamp at which the file was collected."},"available_for_download":{"type":"boolean"},"download_url":{"type":"string","format":"uri","nullable":true,"description":"Time-limited signed URL to download the file. Populated only when `available_for_download` is `true`."}}}}}}
```

## The InvestigationsResponse object

```json
{"openapi":"3.0.2","info":{"title":"Cortex XSIAM Forensics REST API","version":"3.x"},"components":{"schemas":{"InvestigationsResponse":{"type":"object","properties":{"reply":{"type":"object","properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/Investigation"}},"total_count":{"type":"integer"}}}}},"Investigation":{"type":"object","properties":{"id":{"type":"string","format":"uuid"},"created_at":{"type":"string","format":"date-time"},"updated_at":{"type":"string","format":"date-time"},"created_by":{"type":"string","description":"Email or identifier of the user that created the investigation."},"updated_by":{"type":"string","description":"Email or identifier of the user that last updated the investigation."},"name":{"type":"string"},"description":{"type":"string"},"status":{"type":"string","enum":["open","close_pending"]},"expires_at":{"type":"string","format":"date-time","nullable":true},"total_collections":{"type":"integer","nullable":true},"completed_collections":{"type":"integer","nullable":true}}}}}}
```

## The CollectionsResponse object

```json
{"openapi":"3.0.2","info":{"title":"Cortex XSIAM Forensics REST API","version":"3.x"},"components":{"schemas":{"CollectionsResponse":{"type":"object","properties":{"reply":{"type":"object","properties":{"data":{"$ref":"#/components/schemas/CollectionsByType"},"total_count":{"type":"integer"}}}}},"CollectionsByType":{"type":"object","properties":{"hunts":{"type":"array","items":{"$ref":"#/components/schemas/HuntCollection"}},"triages":{"type":"array","items":{"$ref":"#/components/schemas/TriageCollection"}}}},"HuntCollection":{"type":"object","properties":{"id":{"type":"string","format":"uuid"},"type":{"type":"string","enum":["hunt"]},"investigation_id":{"type":"string","format":"uuid"},"name":{"type":"string"},"os":{"type":"string","description":"Operating system the collection targets (for example `WINDOWS`, `LINUX`, `MACOS`)."},"last_received_at":{"type":"integer","description":"Epoch-millisecond timestamp of the most recent result received for the collection."},"status":{"type":"string","nullable":true},"total_searches":{"type":"integer"},"searches":{"type":"array","items":{"type":"string","format":"uuid"},"description":"Identifiers of the hunt searches belonging to this collection."}}},"TriageCollection":{"type":"object","properties":{"id":{"type":"string","format":"uuid"},"type":{"type":"string","enum":["triage"]},"investigation_id":{"type":"string","format":"uuid"},"name":{"type":"string"},"os":{"type":"string"},"last_received_at":{"type":"integer","description":"Epoch-millisecond timestamp of the most recent result received for the collection."},"status":{"type":"string","nullable":true},"total_agents":{"type":"integer"},"agents":{"type":"array","items":{"type":"string","format":"uuid"},"description":"Identifiers of the agents that contributed data to this collection."}}}}}}
```

## The HuntResultsResponse object

```json
{"openapi":"3.0.2","info":{"title":"Cortex XSIAM Forensics REST API","version":"3.x"},"components":{"schemas":{"HuntResultsResponse":{"type":"object","properties":{"reply":{"type":"object","properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/HuntResult"}},"total_count":{"type":"integer"}}}}},"HuntResult":{"type":"object","properties":{"id":{"type":"string","format":"uuid"},"created_at":{"type":"string","format":"date-time"},"category":{"type":"string","description":"Logical category of the artifact returned by the search."},"artifact_type":{"type":"string","description":"Public name of the forensic artifact table that holds the result rows. Use this value as `artifact_type` when calling `/get_data`."},"filters":{"type":"object","description":"Search parameters that were applied to produce the result.","additionalProperties":true},"status":{"type":"string"},"total_results":{"type":"integer"}}}}}}
```

## The TriageResultsResponse object

```json
{"openapi":"3.0.2","info":{"title":"Cortex XSIAM Forensics REST API","version":"3.x"},"components":{"schemas":{"TriageResultsResponse":{"type":"object","properties":{"reply":{"type":"object","properties":{"data":{"$ref":"#/components/schemas/TriageResultsByType"},"total_count":{"type":"integer"}}}}},"TriageResultsByType":{"type":"object","properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/TriageDataArtifactSummary"}},"files":{"type":"array","items":{"$ref":"#/components/schemas/TriageFileArtifactSummary"}}}},"TriageDataArtifactSummary":{"type":"object","properties":{"id":{"type":"string","format":"uuid"},"created_at":{"type":"integer","description":"Epoch-millisecond timestamp."},"artifact_type":{"type":"string"},"status":{"type":"string","description":"Normalised upper-case status (for example `COMPLETED`, `FAILED`)."},"total_results":{"type":"integer"}}},"TriageFileArtifactSummary":{"type":"object","properties":{"id":{"type":"string","format":"uuid"},"created_at":{"type":"integer","description":"Epoch-millisecond timestamp."},"artifact_type":{"type":"string"},"status":{"type":"string"},"successful_file_paths":{"type":"array","items":{"type":"string"},"description":"File paths that were collected successfully. Populated only when the artifact succeeded."},"failed_file_paths":{"type":"array","items":{"type":"string"},"description":"File paths that the agent failed to collect. Populated when the artifact did not succeed."},"total_files":{"type":"integer"},"total_results":{"type":"integer"}}}}}}
```

## The RawRowsResponse object

```json
{"openapi":"3.0.2","info":{"title":"Cortex XSIAM Forensics REST API","version":"3.x"},"components":{"schemas":{"RawRowsResponse":{"type":"object","properties":{"reply":{"type":"object","properties":{"data":{"type":"array","items":{"type":"object","additionalProperties":true,"description":"Artifact row whose shape depends on `artifact_type`."}},"total_count":{"type":"integer"}}}}}}}}
```

## The HostTimelineResponse object

```json
{"openapi":"3.0.2","info":{"title":"Cortex XSIAM Forensics REST API","version":"3.x"},"components":{"schemas":{"HostTimelineResponse":{"type":"object","properties":{"reply":{"type":"object","properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/HostTimelineRow"}},"total_count":{"type":"integer"}}}}},"HostTimelineRow":{"type":"object","properties":{"uuid":{"type":"string","format":"uuid"},"agent_id":{"type":"string","format":"uuid"},"timeline_id":{"type":"string"},"host_name":{"type":"string"},"generated_time":{"type":"integer","description":"Epoch-millisecond timestamp at which the row was generated by the agent."},"timestamp":{"type":"integer","description":"Epoch-millisecond timestamp of the event itself."},"timestamp_partition":{"type":"integer","description":"Date partition (YYYYMMDD) the row belongs to."},"description":{"type":"string"},"type":{"type":"string","description":"Event type (for example `PROCESS`, `FILE`, `REGISTRY`)."},"user":{"type":"string"},"data":{"type":"object","description":"Event-type-specific payload.","additionalProperties":true},"tags":{"type":"array","items":{"type":"string"}},"source_row_uuid":{"type":"string","format":"uuid"},"os":{"type":"string"}}}}}}
```

## The TriageFilesResponse object

```json
{"openapi":"3.0.2","info":{"title":"Cortex XSIAM Forensics REST API","version":"3.x"},"components":{"schemas":{"TriageFilesResponse":{"type":"object","properties":{"reply":{"type":"object","properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/TriageCollectedFile"}},"total_count":{"type":"integer"}}}}},"TriageCollectedFile":{"type":"object","properties":{"id":{"type":"string","format":"uuid","description":"Identifier of the parent triage-result row."},"file_path":{"type":"string"},"time_collected":{"type":"integer","description":"Epoch-millisecond timestamp at which the file was collected."},"available_for_download":{"type":"boolean"},"download_url":{"type":"string","format":"uri","nullable":true,"description":"Time-limited signed URL to download the file. Populated only when `available_for_download` is `true`."}}}}}}
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/xsiam-api/forensics/models.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.