Investigations

APIs for managing playground investigations

Search investigations by filter

post

This will search investigations across all indices You can filter by multiple options

Authorizations

AuthorizationstringRequired

Body

Responses

200

investigationSearchResponse

application/json

InvestigationSearchResponse returns the response from the investigation search

totalinteger · int64Optional

post/investigations/search

POST /investigations/search HTTP/1.1
Host: hostname
Authorization: YOUR_API_KEY
Content-Type: application/json
Accept: */*
Content-Length: 887

{
  "filter": {
    "Cache": {
      "ANY_ADDITIONAL_PROPERTY": [
        "text"
      ]
    },
    "andOp": true,
    "category": [
      "text"
    ],
    "fromCloseDate": "2026-01-01T00:00:00.000Z",
    "fromDate": "2026-01-01T00:00:00.000Z",
    "fromDateLicense": "2026-01-01T00:00:00.000Z",
    "id": [
      "text"
    ],
    "idsOnly": true,
    "ignoreWorkers": true,
    "includeChildInv": true,
    "name": [
      "text"
    ],
    "notCategory": [
      "text"
    ],
    "notIDs": [
      "text"
    ],
    "page": 1,
    "period": {
      "by": "text",
      "byFrom": "text",
      "byTo": "text",
      "field": "text",
      "fromValue": "text",
      "toValue": "text"
    },
    "reason": [
      "text"
    ],
    "searchAfter": [
      "text"
    ],
    "searchAfterElastic": [
      "text"
    ],
    "searchAfterMap": {
      "ANY_ADDITIONAL_PROPERTY": [
        "text"
      ]
    },
    "searchAfterMapOrder": {
      "ANY_ADDITIONAL_PROPERTY": 1
    },
    "searchBefore": [
      "text"
    ],
    "searchBeforeElastic": [
      "text"
    ],
    "size": 1,
    "sort": [
      {
        "asc": true,
        "field": "text",
        "fieldType": "text"
      }
    ],
    "status": [
      1
    ],
    "timeFrame": 1,
    "toCloseDate": "2026-01-01T00:00:00.000Z",
    "toDate": "2026-01-01T00:00:00.000Z",
    "type": [
      1
    ],
    "user": [
      "text"
    ]
  }
}

200

investigationSearchResponse

{
  "data": [
    {
      "ShardID": 1,
      "allRead": true,
      "allReadWrite": true,
      "cacheVersn": 1,
      "category": "text",
      "childInvestigations": [
        "text"
      ],
      "closed": "2026-01-01T00:00:00.000Z",
      "closingUserId": "text",
      "created": "2026-01-01T00:00:00.000Z",
      "creatingUserId": "text",
      "dbotCreatedBy": "text",
      "details": "text",
      "entitlements": [
        "text"
      ],
      "entryUsers": [
        "text"
      ],
      "hasRole": true,
      "highPriority": true,
      "highlight": {
        "ANY_ADDITIONAL_PROPERTY": [
          "text"
        ]
      },
      "id": "text",
      "indexName": "text",
      "isChildInvestigation": true,
      "isDebug": true,
      "lastOpen": "2026-01-01T00:00:00.000Z",
      "mirrorAutoClose": {
        "ANY_ADDITIONAL_PROPERTY": true
      },
      "mirrorTypes": {
        "ANY_ADDITIONAL_PROPERTY": "text"
      },
      "modified": "2026-01-01T00:00:00.000Z",
      "name": "text",
      "numericId": 1,
      "openDuration": 1,
      "parentInvestigation": "text",
      "persistentEntitlements": {
        "ANY_ADDITIONAL_PROPERTY": "text"
      },
      "previousAllRead": true,
      "previousAllReadWrite": true,
      "previousRoles": [
        "text"
      ],
      "primaryTerm": 1,
      "rawCategory": "text",
      "reason": {
        "ANY_ADDITIONAL_PROPERTY": "text"
      },
      "roles": [
        "text"
      ],
      "runStatus": "text",
      "sequenceNumber": 1,
      "sizeInBytes": 1,
      "slackMirrorAutoClose": true,
      "slackMirrorType": "text",
      "sortValues": [
        "text"
      ],
      "status": 1,
      "syncHash": "text",
      "systems": [
        {
          "agent": {
            "servercontext": [
              1
            ]
          },
          "arch": "text",
          "ciphers": [
            "text"
          ],
          "credentials": "text",
          "engineId": "text",
          "host": "text",
          "integrationinstanceid": "text",
          "issharedagent": true,
          "name": "text",
          "os": "text",
          "password": "text",
          "servicesID": "text",
          "smb": 1,
          "smbport": 1,
          "sshkey": "text",
          "sshport": 1,
          "terminalOptions": {
            "Echo": 1,
            "Terminal": true,
            "TerminalHeight": 1,
            "TerminalType": "text",
            "TerminalWidth": 1,
            "TyISpeed": 1,
            "TyOSpeed": 1
          },
          "user": "text",
          "workgroup": "text"
        }
      ],
      "tags": [
        "text"
      ],
      "type": 1,
      "users": [
        "text"
      ],
      "version": 1,
      "xsoarHasReadOnlyRole": true,
      "xsoarPreviousReadOnlyRoles": [
        "text"
      ],
      "xsoarReadOnlyRoles": [
        "text"
      ]
    }
  ],
  "total": 1
}