Ctrlk
BlogSupport
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Investigations

APIs for managing playground investigations

Retrieve an incident investigation

post

Retrieve the details of an incident investigation.

Path parameters
incident_idstringRequired
Body
objectOptional
Responses
200

OK

application/json

A special investigation called playground is created for each user-project combination and is a private space for the researcher to play in.

ShardIDinteger · int64Optional
allReadbooleanOptional
allReadWritebooleanOptional
cacheVersninteger · int64Optional
categorystringOptional

Category of the investigation

childInvestigationsstring[]Optional

ChildInvestigations id's

closedstring · date-timeOptional

When was this closed

closingUserIdstringOptional

The user ID that closed this investigation

createdstring · date-timeOptional
creatingUserIdstringOptional

The user ID that created this investigation

dbotCreatedBystringOptional

Who has created this event - relevant only for manual incidents

detailsstringOptional

User defined free text details

entitlementsstring[]Optional

One time entitlements

entryUsersstring[]Optional

EntryUsers

hasRolebooleanOptional

Internal field to make queries on role faster

highPrioritybooleanOptional

HighPriority - tasks of this investigation should run in high priority

idstringOptional
indexNamestringOptional
isChildInvestigationbooleanOptional

IsChildInvestigation

isDebugbooleanOptional

IsDebug ...

lastOpenstring · date-timeOptional
modifiedstring · date-timeOptional
namestringOptional

The name of the investigation, which is unique to the project

numericIdinteger · int64Optional
openDurationinteger · int64Optional

Duration from open to close time

parentInvestigationstringOptional

ParentInvestigation - parent id, in case this is a child investigation of another investigation

previousAllReadbooleanOptional
previousAllReadWritebooleanOptional
previousRolesstring[]Optional

Do not change this field manually

primaryTerminteger · int64Optional
rawCategorystringOptional
rolesstring[]Optional

The role assigned to this investigation

runStatusstringOptional

Run status of a job.

sequenceNumberinteger · int64Optional
sizeInBytesinteger · int64Optional
slackMirrorAutoClosebooleanOptional

DEPRECATED - DeprecatedSlackMirrorAutoClose will tell us to close the Slack channel if we close investigation

slackMirrorTypestringOptional

DEPRECATED - DeprecatedSlackMirrorType holds info about mirror direction and message type to be mirror message type can be either 'all' or 'chat' direction can be either 'demisto2Slack', 'slack2Demisto' or 'both' if this investigation is mirrored to Slack

sortValuesstring[]Optional
statusnumber · doubleOptional

InvestigationStatus is the status type

syncHashstringOptional
tagsstring[]Optional

Tags

typenumber · doubleOptional
usersstring[]Optional

The users who share this investigation

versioninteger · int64Optional
xsoarHasReadOnlyRolebooleanOptional
xsoarPreviousReadOnlyRolesstring[]Optional
xsoarReadOnlyRolesstring[]Optional
post/xsoar/public/v1/investigation/{incident_id}
POST /xsoar/public/v1/investigation/{incident_id} HTTP/1.1
Host: api-yourfqdn
Content-Type: application/json
Accept: */*
Content-Length: 2

{}
200

OK

{
  "cacheVersn": 0,
  "category": "",
  "childs": null,
  "closed": "0001-01-01T00:00:00Z",
  "created": "2024-02-21T09:41:41.293Z",
  "creatingUserId": "PAPIUser_3992",
  "dbotCreatedBy": "user@company.com",
  "details": "",
  "entries": [
    {
      "IndicatorTimeline": null,
      "InstanceID": "",
      "Relationships": null,
      "brand": "none",
      "cacheVersn": 0,
      "category": "procedural",
      "contents": "### Initial investigation data is being processed. Please wait.",
      "contentsSize": 63,
      "created": "2024-02-21T09:41:42.121692Z",
      "cronView": false,
      "dbotCreatedBy": "user@company.com",
      "endingDate": "0001-01-01T00:00:00Z",
      "entryTask": null,
      "errorSource": "",
      "file": "",
      "fileID": "",
      "fileMetadata": null,
      "format": "markdown",
      "id": "3010eae2-3e4d-4e55-8cbc-a05c8df177bd@157448",
      "incidentCreationTime": "2024-02-21T09:41:42.121692996Z",
      "investigationCreationTime": "2024-02-21T09:41:41.293Z",
      "investigationId": "157448",
      "isTodo": false,
      "mirrored": false,
      "modified": "2024-02-21T09:41:42.123151573Z",
      "note": false,
      "parentContent": null,
      "parentEntryTruncated": false,
      "parentId": "",
      "pinned": false,
      "playbookId": "",
      "recurrent": false,
      "reputationSize": 0,
      "reputations": null,
      "retryTime": "0001-01-01T00:00:00Z",
      "scheduled": false,
      "scheduledEntryGuid": "",
      "sizeInBytes": 0,
      "startDate": "0001-01-01T00:00:00Z",
      "system": "",
      "tags": null,
      "tagsRaw": null,
      "taskId": "",
      "times": 0,
      "timezoneOffset": 0,
      "type": 1,
      "user": "",
      "version": 1
    },
    {
      "IndicatorTimeline": null,
      "InstanceID": "",
      "Relationships": null,
      "brand": "none",
      "cacheVersn": 0,
      "category": "procedural",
      "contents": "See [Incident Fields Table](https://app.gitbook.com/s/dXXxClt1YkGQlGTYJWdB/cortex-xsoar-8.x-apis/XSOAR-8-tables#incident-fields-table) for details.",
      "contentsSize": 8440,
      "created": "2024-02-21T09:41:42.311809Z",
      "cronView": false,
      "dbotCreatedBy": "user@company.com",
      "endingDate": "0001-01-01T00:00:00Z",
      "entryTask": null,
      "errorSource": "",
      "file": "",
      "fileID": "",
      "fileMetadata": null,
      "format": "markdown",
      "id": "78959c35-b09d-4eae-84a4-cc117ba704bd@157448",
      "incidentCreationTime": "2024-02-21T09:41:42.311809788Z",
      "investigationCreationTime": "2024-02-21T09:41:41.293Z",
      "investigationId": "157448",
      "isTodo": false,
      "mirrored": false,
      "modified": "2024-02-21T09:41:42.313227616Z",
      "note": false,
      "parentContent": null,
      "parentEntryTruncated": false,
      "parentId": "",
      "pinned": false,
      "playbookId": "",
      "recurrent": false,
      "reputationSize": 0,
      "reputations": null,
      "retryTime": "0001-01-01T00:00:00Z",
      "scheduled": false,
      "scheduledEntryGuid": "",
      "sizeInBytes": 0,
      "startDate": "0001-01-01T00:00:00Z",
      "system": "",
      "tags": null,
      "tagsRaw": null,
      "taskId": "",
      "times": 0,
      "timezoneOffset": 0,
      "type": 1,
      "user": "",
      "version": 1
    },
    {
      "IndicatorTimeline": null,
      "InstanceID": "",
      "Relationships": null,
      "brand": "none",
      "cacheVersn": 0,
      "category": "procedural",
      "contents": "See [Label Type Table](https://app.gitbook.com/s/dXXxClt1YkGQlGTYJWdB/cortex-xsoar-8.x-apis/XSOAR-8-tables#label-type-table) for details.",
      "contentsSize": 99,
      "created": "2024-02-21T09:41:42.400544Z",
      "cronView": false,
      "dbotCreatedBy": "user@company.com",
      "endingDate": "0001-01-01T00:00:00Z",
      "entryTask": null,
      "errorSource": "",
      "file": "",
      "fileID": "",
      "fileMetadata": null,
      "format": "markdown",
      "id": "63d7b86c-08cb-42d0-89c1-859294757458@157448",
      "incidentCreationTime": "2024-02-21T09:41:42.400544426Z",
      "investigationCreationTime": "2024-02-21T09:41:41.293Z",
      "investigationId": "157448",
      "isTodo": false,
      "mirrored": false,
      "modified": "2024-02-21T09:41:42.402304066Z",
      "note": false,
      "parentContent": null,
      "parentEntryTruncated": false,
      "parentId": "",
      "pinned": false,
      "playbookId": "",
      "recurrent": false,
      "reputationSize": 0,
      "reputations": null,
      "retryTime": "0001-01-01T00:00:00Z",
      "scheduled": false,
      "scheduledEntryGuid": "",
      "sizeInBytes": 0,
      "startDate": "0001-01-01T00:00:00Z",
      "system": "",
      "tags": null,
      "tagsRaw": null,
      "taskId": "",
      "times": 0,
      "timezoneOffset": 0,
      "type": 1,
      "user": "",
      "version": 1
    },
    {
      "IndicatorTimeline": null,
      "InstanceID": "",
      "Relationships": null,
      "brand": "none",
      "cacheVersn": 0,
      "category": "procedural",
      "contents": "### Processing of initial investigation data is complete.",
      "contentsSize": 57,
      "created": "2024-02-21T09:41:42.546383Z",
      "cronView": false,
      "dbotCreatedBy": "user@company.com",
      "endingDate": "0001-01-01T00:00:00Z",
      "entryTask": null,
      "errorSource": "",
      "file": "",
      "fileID": "",
      "fileMetadata": null,
      "format": "markdown",
      "id": "d6534983-cb57-41bb-8172-c7ade217f3e1@157448",
      "incidentCreationTime": "2024-02-21T09:41:42.546383237Z",
      "investigationCreationTime": "2024-02-21T09:41:41.293Z",
      "investigationId": "157448",
      "isTodo": false,
      "mirrored": false,
      "modified": "2024-02-21T09:41:42.548008817Z",
      "note": false,
      "parentContent": null,
      "parentEntryTruncated": false,
      "parentId": "",
      "pinned": false,
      "playbookId": "",
      "recurrent": false,
      "reputationSize": 0,
      "reputations": null,
      "retryTime": "0001-01-01T00:00:00Z",
      "scheduled": false,
      "scheduledEntryGuid": "",
      "sizeInBytes": 0,
      "startDate": "0001-01-01T00:00:00Z",
      "system": "",
      "tags": null,
      "tagsRaw": null,
      "taskId": "",
      "times": 0,
      "timezoneOffset": 0,
      "type": 1,
      "user": "",
      "version": 1
    },
    {
      "IndicatorTimeline": null,
      "InstanceID": "",
      "Relationships": null,
      "brand": "none",
      "cacheVersn": 0,
      "category": "procedural",
      "contents": "Task #1 'blabla' was added to Workplan by user@company.com.",
      "contentsSize": 74,
      "created": "2024-02-21T10:16:03.234307Z",
      "cronView": false,
      "dbotCreatedBy": "user@company.com",
      "endingDate": "0001-01-01T00:00:00Z",
      "entryTask": null,
      "errorSource": "",
      "file": "",
      "fileID": "",
      "fileMetadata": null,
      "format": "text",
      "id": "b3030dd5-a0e1-440b-85e6-c3a492d7c655@157448",
      "incidentCreationTime": "2024-02-21T10:16:03.234307352Z",
      "investigationCreationTime": "2024-02-21T09:41:41.293Z",
      "investigationId": "157448",
      "isTodo": false,
      "mirrored": false,
      "modified": "2024-02-21T10:16:03.236557712Z",
      "note": false,
      "parentContent": null,
      "parentEntryTruncated": false,
      "parentId": "",
      "pinned": false,
      "playbookId": "",
      "recurrent": false,
      "reputationSize": 0,
      "reputations": null,
      "retryTime": "0001-01-01T00:00:00Z",
      "scheduled": false,
      "scheduledEntryGuid": "",
      "sizeInBytes": 0,
      "startDate": "0001-01-01T00:00:00Z",
      "system": "",
      "tags": null,
      "tagsRaw": null,
      "taskId": "",
      "times": 0,
      "timezoneOffset": 0,
      "type": 1,
      "user": "user@company.com",
      "version": 1
    },
    {
      "IndicatorTimeline": null,
      "InstanceID": "",
      "Relationships": null,
      "brand": "none",
      "cacheVersn": 0,
      "category": "chat",
      "contents": "Testing war room tags",
      "contentsSize": 21,
      "created": "2024-02-21T13:02:08.628565Z",
      "cronView": false,
      "dbotCreatedBy": "user@company.com",
      "endingDate": "0001-01-01T00:00:00Z",
      "entryTask": null,
      "errorSource": "",
      "file": "",
      "fileID": "",
      "fileMetadata": null,
      "format": "markdown",
      "id": "5862e602-88c4-4a6b-8491-97acd655f25f@157448",
      "incidentCreationTime": "2024-02-21T13:02:08.628565804Z",
      "investigationCreationTime": "2024-02-21T09:41:41.293Z",
      "investigationId": "157448",
      "isTodo": false,
      "mirrored": false,
      "modified": "2024-02-21T13:03:38.250637249Z",
      "note": true,
      "parentContent": null,
      "parentEntryTruncated": false,
      "parentId": "",
      "pinned": false,
      "playbookId": "",
      "recurrent": false,
      "reputationSize": 0,
      "reputations": null,
      "retryTime": "0001-01-01T00:00:00Z",
      "scheduled": false,
      "scheduledEntryGuid": "",
      "sizeInBytes": 0,
      "startDate": "0001-01-01T00:00:00Z",
      "system": "",
      "tags": [
        "tag_mBIUqRtI",
        "tag_123"
      ],
      "tagsRaw": [
        "tag_mBIUqRtI",
        "tag_123"
      ],
      "taskId": "",
      "times": 0,
      "timezoneOffset": 0,
      "type": 1,
      "user": "user@company.com",
      "version": 3
    },
    {
      "IndicatorTimeline": null,
      "InstanceID": "",
      "Relationships": null,
      "brand": "none",
      "cacheVersn": 0,
      "category": "chat",
      "contents": "testing note",
      "contentsSize": 12,
      "created": "2024-02-21T13:05:55.70602Z",
      "cronView": false,
      "dbotCreatedBy": "user@company.com",
      "endingDate": "0001-01-01T00:00:00Z",
      "entryTask": null,
      "errorSource": "",
      "file": "",
      "fileID": "",
      "fileMetadata": null,
      "format": "markdown",
      "id": "ca462cc7-2969-497c-82fe-870ecee2183f@157448",
      "incidentCreationTime": "2024-02-21T13:05:55.706020952Z",
      "investigationCreationTime": "2024-02-21T09:41:41.293Z",
      "investigationId": "157448",
      "isTodo": false,
      "mirrored": false,
      "modified": "2024-02-21T13:06:24.205833123Z",
      "note": true,
      "parentContent": null,
      "parentEntryTruncated": false,
      "parentId": "",
      "pinned": false,
      "playbookId": "",
      "recurrent": false,
      "reputationSize": 0,
      "reputations": null,
      "retryTime": "0001-01-01T00:00:00Z",
      "scheduled": false,
      "scheduledEntryGuid": "",
      "sizeInBytes": 0,
      "startDate": "0001-01-01T00:00:00Z",
      "system": "",
      "tags": null,
      "tagsRaw": null,
      "taskId": "",
      "times": 0,
      "timezoneOffset": 0,
      "type": 1,
      "user": "user@company.com",
      "version": 3
    },
    {
      "IndicatorTimeline": null,
      "InstanceID": "",
      "Relationships": null,
      "brand": "none",
      "cacheVersn": 0,
      "category": "chat",
      "contents": "test message",
      "contentsSize": 12,
      "created": "2024-02-21T13:08:42.2197Z",
      "cronView": false,
      "dbotCreatedBy": "user@company.com",
      "endingDate": "0001-01-01T00:00:00Z",
      "entryTask": null,
      "errorSource": "",
      "file": "",
      "fileID": "",
      "fileMetadata": null,
      "format": "markdown",
      "id": "42091112-0341-427a-87f0-586bf6ea5e78@157448",
      "incidentCreationTime": "2024-02-21T13:08:42.219700522Z",
      "investigationCreationTime": "2024-02-21T09:41:41.293Z",
      "investigationId": "157448",
      "isTodo": false,
      "mirrored": false,
      "modified": "2024-02-21T13:08:42.219718696Z",
      "note": false,
      "parentContent": null,
      "parentEntryTruncated": false,
      "parentId": "",
      "pinned": false,
      "playbookId": "",
      "recurrent": false,
      "reputationSize": 0,
      "reputations": null,
      "retryTime": "0001-01-01T00:00:00Z",
      "scheduled": false,
      "scheduledEntryGuid": "",
      "sizeInBytes": 0,
      "startDate": "0001-01-01T00:00:00Z",
      "system": "",
      "tags": null,
      "tagsRaw": null,
      "taskId": "",
      "times": 0,
      "timezoneOffset": 0,
      "type": 1,
      "user": "",
      "version": 1
    }
  ],
  "entryUsers": [
    "user@company.com"
  ],
  "highPriority": false,
  "id": "157448",
  "invContext": {
    "cacheVersn": 0,
    "context": null,
    "created": "2024-02-21T09:41:41Z",
    "findings": null,
    "id": "157448",
    "importantKeys": {},
    "modified": "0001-01-01T00:00:00Z",
    "sizeInBytes": 0,
    "version": 1
  },
  "isDebug": false,
  "lastOpen": "0001-01-01T00:00:00Z",
  "mirrorAutoClose": null,
  "mirrorTypes": null,
  "modified": "0001-01-01T00:00:00Z",
  "name": "b",
  "rawCategory": "",
  "reason": null,
  "runStatus": "",
  "sizeInBytes": 0,
  "slackMirrorAutoClose": false,
  "slackMirrorType": "",
  "status": 0,
  "systems": null,
  "tags": [
    "tag_mBIUqRtI",
    "tag_123"
  ],
  "totalEntries": 8,
  "type": 0,
  "users": [
    "user@company.com",
    ""
  ],
  "version": 3
}

Reopen a closed incident

post

Reopen the specified closed incident.

Path parameters
incident_idstringRequired
Body
idstringOptional
versionintegerOptional
Responses
200

OK

application/json
cacheVersnintegerOptional
categorystringOptional
childsnullOptional
closedstringOptional
closingUserIdstringOptional
createdstringOptional
creatingUserIdstringOptional
dbotCreatedBystringOptional
detailsstringOptional
entryUsersstring[]Optional
highPrioritybooleanOptional
idstringOptional
isDebugbooleanOptional
lastOpenstringOptional
mirrorAutoClosenullOptional
mirrorTypesnullOptional
modifiedstringOptional
namestringOptional
openDurationintegerOptional
rawCategorystringOptional
runStatusstringOptional
sizeInBytesintegerOptional
slackMirrorAutoClosebooleanOptional
slackMirrorTypestringOptional
statusintegerOptional
systemsnullOptional
tagsnullOptional
totalEntriesintegerOptional
typeintegerOptional
usersstring[]Optional
versionintegerOptional
post/xsoar/public/v1/investigation/{incident_id}/reopen
POST /xsoar/public/v1/investigation/{incident_id}/reopen HTTP/1.1
Host: api-yourfqdn
Content-Type: application/json
Accept: */*
Content-Length: 27

{
  "id": "157447",
  "version": 3
}
200

OK

{
  "cacheVersn": 0,
  "category": "",
  "childs": null,
  "closed": "2024-02-21T09:35:52.897Z",
  "closingUserId": "PAPIUser_3992",
  "created": "2024-02-21T09:35:04.511Z",
  "creatingUserId": "user@company.com",
  "dbotCreatedBy": "user@company.com",
  "details": "",
  "entries": [
    {
      "IndicatorTimeline": null,
      "InstanceID": "",
      "Relationships": null,
      "brand": "none",
      "cacheVersn": 0,
      "category": "procedural",
      "contents": "### Initial investigation data is being processed. Please wait.",
      "contentsSize": 63,
      "created": "2024-02-21T09:35:05.307966Z",
      "cronView": false,
      "dbotCreatedBy": "user@company.com",
      "endingDate": "0001-01-01T00:00:00Z",
      "entryTask": null,
      "errorSource": "",
      "file": "",
      "fileID": "",
      "fileMetadata": null,
      "format": "markdown",
      "id": "49097215-435a-4f6f-888a-895a2de99b30@157447",
      "incidentCreationTime": "2024-02-21T09:35:05.307966783Z",
      "investigationCreationTime": "2024-02-21T09:35:04.511Z",
      "investigationId": "157447",
      "isTodo": false,
      "mirrored": false,
      "modified": "2024-02-21T09:35:05.309844847Z",
      "note": false,
      "parentContent": null,
      "parentEntryTruncated": false,
      "parentId": "",
      "pinned": false,
      "playbookId": "",
      "recurrent": false,
      "reputationSize": 0,
      "reputations": null,
      "retryTime": "0001-01-01T00:00:00Z",
      "scheduled": false,
      "scheduledEntryGuid": "",
      "sizeInBytes": 0,
      "startDate": "0001-01-01T00:00:00Z",
      "system": "",
      "tags": null,
      "tagsRaw": null,
      "taskId": "",
      "times": 0,
      "timezoneOffset": 0,
      "type": 1,
      "user": "",
      "version": 1
    },
    {
      "IndicatorTimeline": null,
      "InstanceID": "",
      "Relationships": null,
      "brand": "none",
      "cacheVersn": 0,
      "category": "procedural",
      "contents": "See [Incident Fields Table](https://app.gitbook.com/s/dXXxClt1YkGQlGTYJWdB/cortex-xsoar-8.x-apis/XSOAR-8-tables#incident-fields-table) for details.",
      "contentsSize": 8442,
      "created": "2024-02-21T09:35:05.730319Z",
      "cronView": false,
      "dbotCreatedBy": "user@company.com",
      "endingDate": "0001-01-01T00:00:00Z",
      "entryTask": null,
      "errorSource": "",
      "file": "",
      "fileID": "",
      "fileMetadata": null,
      "format": "markdown",
      "id": "d79157d2-900f-4f03-865a-e6d169bcd039@157447",
      "incidentCreationTime": "2024-02-21T09:35:05.730319862Z",
      "investigationCreationTime": "2024-02-21T09:35:04.511Z",
      "investigationId": "157447",
      "isTodo": false,
      "mirrored": false,
      "modified": "2024-02-21T09:35:05.732082438Z",
      "note": false,
      "parentContent": null,
      "parentEntryTruncated": false,
      "parentId": "",
      "pinned": false,
      "playbookId": "",
      "recurrent": false,
      "reputationSize": 0,
      "reputations": null,
      "retryTime": "0001-01-01T00:00:00Z",
      "scheduled": false,
      "scheduledEntryGuid": "",
      "sizeInBytes": 0,
      "startDate": "0001-01-01T00:00:00Z",
      "system": "",
      "tags": null,
      "tagsRaw": null,
      "taskId": "",
      "times": 0,
      "timezoneOffset": 0,
      "type": 1,
      "user": "",
      "version": 1
    },
    {
      "IndicatorTimeline": null,
      "InstanceID": "",
      "Relationships": null,
      "brand": "none",
      "cacheVersn": 0,
      "category": "procedural",
      "contents": "See [Label Type Table](https://app.gitbook.com/s/dXXxClt1YkGQlGTYJWdB/cortex-xsoar-8.x-apis/XSOAR-8-tables#label-type-table) for details.",
      "contentsSize": 99,
      "created": "2024-02-21T09:35:05.836423Z",
      "cronView": false,
      "dbotCreatedBy": "user@company.com",
      "endingDate": "0001-01-01T00:00:00Z",
      "entryTask": null,
      "errorSource": "",
      "file": "",
      "fileID": "",
      "fileMetadata": null,
      "format": "markdown",
      "id": "3e9d0099-6ecc-4c91-87ac-220635b302f1@157447",
      "incidentCreationTime": "2024-02-21T09:35:05.836423213Z",
      "investigationCreationTime": "2024-02-21T09:35:04.511Z",
      "investigationId": "157447",
      "isTodo": false,
      "mirrored": false,
      "modified": "2024-02-21T09:35:05.837588931Z",
      "note": false,
      "parentContent": null,
      "parentEntryTruncated": false,
      "parentId": "",
      "pinned": false,
      "playbookId": "",
      "recurrent": false,
      "reputationSize": 0,
      "reputations": null,
      "retryTime": "0001-01-01T00:00:00Z",
      "scheduled": false,
      "scheduledEntryGuid": "",
      "sizeInBytes": 0,
      "startDate": "0001-01-01T00:00:00Z",
      "system": "",
      "tags": null,
      "tagsRaw": null,
      "taskId": "",
      "times": 0,
      "timezoneOffset": 0,
      "type": 1,
      "user": "",
      "version": 1
    },
    {
      "IndicatorTimeline": null,
      "InstanceID": "",
      "Relationships": null,
      "brand": "none",
      "cacheVersn": 0,
      "category": "procedural",
      "contents": "### Processing of initial investigation data is complete.",
      "contentsSize": 57,
      "created": "2024-02-21T09:35:05.920562Z",
      "cronView": false,
      "dbotCreatedBy": "user@company.com",
      "endingDate": "0001-01-01T00:00:00Z",
      "entryTask": null,
      "errorSource": "",
      "file": "",
      "fileID": "",
      "fileMetadata": null,
      "format": "markdown",
      "id": "7f13074b-3908-412a-8d4d-e5b3d8089d6b@157447",
      "incidentCreationTime": "2024-02-21T09:35:05.920562169Z",
      "investigationCreationTime": "2024-02-21T09:35:04.511Z",
      "investigationId": "157447",
      "isTodo": false,
      "mirrored": false,
      "modified": "2024-02-21T09:35:05.922026218Z",
      "note": false,
      "parentContent": null,
      "parentEntryTruncated": false,
      "parentId": "",
      "pinned": false,
      "playbookId": "",
      "recurrent": false,
      "reputationSize": 0,
      "reputations": null,
      "retryTime": "0001-01-01T00:00:00Z",
      "scheduled": false,
      "scheduledEntryGuid": "",
      "sizeInBytes": 0,
      "startDate": "0001-01-01T00:00:00Z",
      "system": "",
      "tags": null,
      "tagsRaw": null,
      "taskId": "",
      "times": 0,
      "timezoneOffset": 0,
      "type": 1,
      "user": "",
      "version": 1
    },
    {
      "IndicatorTimeline": null,
      "InstanceID": "",
      "Relationships": null,
      "brand": "none",
      "cacheVersn": 0,
      "category": "procedural",
      "contents": "See [Field Changes Table](https://app.gitbook.com/s/dXXxClt1YkGQlGTYJWdB/cortex-xsoar-8.x-apis/XSOAR-8-tables#field-changes-table) for details.",
      "contentsSize": 128,
      "created": "2024-02-21T09:35:54.094488Z",
      "cronView": false,
      "endingDate": "0001-01-01T00:00:00Z",
      "entryTask": null,
      "errorSource": "",
      "file": "",
      "fileID": "",
      "fileMetadata": null,
      "format": "markdown",
      "id": "8fbc39b1-603b-4e9f-80f1-38c41c0c629c@157447",
      "incidentCreationTime": "2024-02-21T09:35:54.094488638Z",
      "investigationCreationTime": "2024-02-21T09:35:04.511Z",
      "investigationId": "157447",
      "isTodo": false,
      "mirrored": false,
      "modified": "2024-02-21T09:35:54.094519531Z",
      "note": false,
      "parentContent": null,
      "parentEntryTruncated": false,
      "parentId": "",
      "pinned": false,
      "playbookId": "",
      "recurrent": false,
      "reputationSize": 0,
      "reputations": null,
      "retryTime": "0001-01-01T00:00:00Z",
      "scheduled": false,
      "scheduledEntryGuid": "",
      "sizeInBytes": 0,
      "startDate": "0001-01-01T00:00:00Z",
      "system": "",
      "tags": null,
      "tagsRaw": null,
      "taskId": "",
      "times": 0,
      "timezoneOffset": 0,
      "type": 1,
      "user": "PAPIUser_3992",
      "version": 1
    },
    {
      "IndicatorTimeline": null,
      "InstanceID": "",
      "Relationships": null,
      "brand": "none",
      "cacheVersn": 0,
      "category": "procedural",
      "contents": "{\"Close Notes\":\"close_note_oAZROKPJ\",\"Close Reason\":\"\",\"Duration\":\"48s\"}",
      "contentsSize": 72,
      "created": "2024-02-21T09:35:54.352294Z",
      "cronView": false,
      "dbotCreatedBy": "user@company.com",
      "endingDate": "0001-01-01T00:00:00Z",
      "entryTask": null,
      "errorSource": "",
      "file": "",
      "fileID": "",
      "fileMetadata": null,
      "format": "table",
      "id": "cc475a73-a366-407f-8227-ffc1c2033065@157447",
      "incidentCreationTime": "2024-02-21T09:35:54.352294485Z",
      "investigationCreationTime": "2024-02-21T09:35:04.511Z",
      "investigationId": "157447",
      "isTodo": false,
      "mirrored": false,
      "modified": "2024-02-21T09:35:54.353493686Z",
      "note": false,
      "parentContent": null,
      "parentEntryTruncated": false,
      "parentId": "",
      "pinned": false,
      "playbookId": "",
      "recurrent": false,
      "reputationSize": 0,
      "reputations": null,
      "retryTime": "0001-01-01T00:00:00Z",
      "scheduled": false,
      "scheduledEntryGuid": "",
      "sizeInBytes": 0,
      "startDate": "0001-01-01T00:00:00Z",
      "system": "",
      "tags": null,
      "tagsRaw": null,
      "taskId": "",
      "times": 0,
      "timezoneOffset": 0,
      "type": 1,
      "user": "PAPIUser_3992",
      "version": 1
    }
  ],
  "entryUsers": [
    "PAPIUser_3992"
  ],
  "highPriority": false,
  "id": "157447",
  "invContext": {
    "cacheVersn": 0,
    "context": null,
    "created": "2024-02-21T09:35:05Z",
    "findings": null,
    "id": "157447",
    "importantKeys": {},
    "modified": "0001-01-01T00:00:00Z",
    "sizeInBytes": 0,
    "version": 1
  },
  "isDebug": false,
  "lastOpen": "0001-01-01T00:00:00Z",
  "mirrorAutoClose": null,
  "mirrorTypes": null,
  "modified": "0001-01-01T00:00:00Z",
  "name": "abc",
  "openDuration": 48,
  "rawCategory": "",
  "reason": {
    "Close Notes": "close_note_oAZROKPJ",
    "Close Reason": ""
  },
  "runStatus": "",
  "sizeInBytes": 0,
  "slackMirrorAutoClose": false,
  "slackMirrorType": "",
  "status": 1,
  "systems": null,
  "tags": null,
  "totalEntries": 6,
  "type": 0,
  "users": [
    "user@company.com"
  ],
  "version": 3
}

Get investigation workplan

get

Get the investigation workplan for the specified incident.

Path parameters
incident_idstringRequired
Responses
200

Success

application/json
cacheVersnintegerOptional
categorystringOptional
childsnullOptional
closedstringOptional
closingUserIdstringOptional
createdstringOptional
creatingUserIdstringOptional
dbotCreatedBystringOptional
detailsstringOptional
entryUsersstring[]Optional
highPrioritybooleanOptional
idstringOptional
invContextnullOptional
invPlaybooknullOptional
isDebugbooleanOptional
lastOpenstringOptional
mirrorAutoClosenullOptional
mirrorTypesnullOptional
modifiedstringOptional
namestringOptional
openDurationintegerOptional
rawCategorystringOptional
runStatusstringOptional
sizeInBytesintegerOptional
slackMirrorAutoClosebooleanOptional
slackMirrorTypestringOptional
statusintegerOptional
systemsnullOptional
tagsnullOptional
totalEntriesintegerOptional
typeintegerOptional
usersstring[]Optional
versionintegerOptional
get/xsoar/public/v1/investigation/{incident_id}/workplan
GET /xsoar/public/v1/investigation/{incident_id}/workplan HTTP/1.1
Host: api-yourfqdn
Accept: */*
200

Success

{
  "cacheVersn": 0,
  "category": "",
  "childs": null,
  "closed": "2024-02-21T12:58:41.682Z",
  "closingUserId": "PAPIUser_3992",
  "created": "2024-02-21T09:35:04.511Z",
  "creatingUserId": "user@company.com",
  "dbotCreatedBy": "user@company.com",
  "details": "",
  "entryUsers": [
    "PAPIUser_3992",
    "user@company.com"
  ],
  "highPriority": false,
  "id": "157447",
  "invContext": null,
  "invPlaybook": null,
  "isDebug": false,
  "lastOpen": "2024-02-21T12:58:28.233Z",
  "mirrorAutoClose": null,
  "mirrorTypes": null,
  "modified": "0001-01-01T00:00:00Z",
  "name": "abc",
  "openDuration": 10699,
  "rawCategory": "",
  "reason": {
    "Close Notes": "close_note_oAZROKPJ_ddd",
    "Close Reason": ""
  },
  "runStatus": "",
  "sizeInBytes": 0,
  "slackMirrorAutoClose": false,
  "slackMirrorType": "",
  "status": 1,
  "systems": null,
  "tags": null,
  "totalEntries": 0,
  "type": 0,
  "users": [
    "user@company.com"
  ],
  "version": 8
}

Retrieve an investigation workplan task list

post

Retrieve the details of an investigation workplan task list.

Path parameters
incident_idstringRequired
Body
statesstring[]Optional
typesstring[]Optional
Responses
200

OK

application/json
ReopenbooleanOptional
ancestorsstring[]Optional
completedDatestringOptional
continueOnErrorTypestringOptional
dueDatestringOptional
evidenceDataobjectOptional
hasErrorEntriesbooleanOptional
idstringOptional
indentintegerOptional
patchedbooleanOptional
startDatestringOptional
statestringOptional
taskIdstringOptional
typestringOptional
post/xsoar/public/v1/investigation/{incident_id}/workplan/tasks
POST /xsoar/public/v1/investigation/{incident_id}/workplan/tasks HTTP/1.1
Host: api-yourfqdn
Content-Type: application/json
Accept: */*
Content-Length: 88

{
  "states": [
    "Error",
    "Waiting",
    "inprogress"
  ],
  "types": [
    "regular",
    "condition",
    "collection"
  ]
}
200

OK

[
  {
    "Reopen": false,
    "ancestors": [
      "Ad-hoc playbook for incident b"
    ],
    "completedDate": "0001-01-01T00:00:00Z",
    "continueOnErrorType": "",
    "dueDate": "0001-01-01T00:00:00Z",
    "evidenceData": {},
    "hasErrorEntries": false,
    "id": "1",
    "indent": 1,
    "patched": true,
    "previousTasks": {
      "#none#": [
        "0"
      ]
    },
    "startDate": "2024-02-21T10:16:02.528415215Z",
    "state": "Waiting",
    "task": {
      "cacheVersn": 0,
      "id": "1d46e54e-b131-4099-875a-f3f086b425e4",
      "modified": "0001-01-01T00:00:00Z",
      "name": "blabla",
      "sizeInBytes": 0,
      "type": "regular",
      "version": 0
    },
    "taskId": "1d46e54e-b131-4099-875a-f3f086b425e4",
    "type": "regular",
    "view": {
      "position": {
        "x": 450,
        "y": 50
      }
    }
  }
]

Get investigation ID context

post

Retrieve all context values from the specified investigation.

You can use the Cortex XSOAR Transform Language (DT).

For example, if you have context data in the specified investigation as follows: my_key: "my_value", you can run the following API query:

https://api-{fqdn}/xsoar/public/v1/investigation/{investigation_id}/context' -H "Authorization:$api_key" -H "x-xdr-auth-id:$api_key_id" -H "Content-Type:application/json" -d '{"query":"${.}"}

you would get the following response:

{
    "my_key":"my_value"
    }

If you run the following query:

https://api-{fqdn}/xsoar/public/v1/investigation/{investigation_id}/context' -H "Authorization:$api_key" -H "x-xdr-auth-id:$api_key_id" -H "Content-Type:application/json" -d '{"query":"${.my_key}"}

you would get the following response:

"my_value"
Path parameters
investigation_idstringRequired

Investigation ID

Header parameters
authorizationstringRequired

api_key

Example: DCdIeow0xm73EwnxjPza1tdHTfZQv2eH7bTKlTPkgBHLj8aSjFzjgTE9bQUK1DidlWLrnYRhaYQ4PCIyNrNJbMUC6DOWi8ANIn1JWpMTE2neGvoDIRsKUbj6pJ1z7Gmr
x-xdr-auth-idstringRequired

api_key_id

Example: 2841
Body
querystringOptional
Responses
200

OK

application/json
my_keystringOptional
post/xsoar/public/v1/investigation/{investigation_id}/context
POST /xsoar/public/v1/investigation/{investigation_id}/context HTTP/1.1
Host: api-yourfqdn
authorization: DCdIeow0xm73EwnxjPza1tdHTfZQv2eH7bTKlTPkgBHLj8aSjFzjgTE9bQUK1DidlWLrnYRhaYQ4PCIyNrNJbMUC6DOWi8ANIn1JWpMTE2neGvoDIRsKUbj6pJ1z7Gmr
x-xdr-auth-id: 2841
Content-Type: application/json
Accept: */*
Content-Length: 16

{
  "query": "${.}"
}
200

OK

{
  "my_key": "my_value"
}

Close an investigation

post

Close the specified investigation.

Path parameters
investigation_idstringRequired

Investigation ID

Header parameters
authorizationstringRequired

api_key

Example: DCdIeow0xm73EwnxjPza1tdHTfZQv2eH7bTKlTPkgBHLj8aSjFzjgTE9bQUK1DidlWLrnYRhaYQ4PCIyNrNJbMUC6DOWi8ANIn1JWpMTE2neGvoDIRsKUbj6pJ1z7Gmr
x-xdr-auth-idstringRequired

api_key_id

Example: 2841
Body
closeNotesstringOptional

Descriptive notes explaining why the investigation is closed.

closeReasonstringOptional

Reason the investigation is closed.

Responses
200

OK

application/json
idstringOptional
versionintegerOptional
cacheVersnintegerOptional
modifiedstringOptional
sizeInBytesintegerOptional
typeintegerOptional
createdstringOptional
incidentCreationTimestringOptional
investigationCreationTimestringOptional
retryTimestringOptional
userstringOptional
errorSourcestringOptional
contentsstringOptional
formatstringOptional
investigationIdstringOptional
filestringOptional
fileIDstringOptional
parentIdstringOptional
pinnedbooleanOptional
fileMetadatanullOptional
parentContentnullOptional
parentEntryTruncatedbooleanOptional
systemstringOptional
reputationsnullOptional
categorystringOptional
notebooleanOptional
isTodobooleanOptional
tagsnullOptional
tagsRawnullOptional
startDatestringOptional
timesintegerOptional
recurrentbooleanOptional
endingDatestringOptional
timezoneOffsetintegerOptional
cronViewbooleanOptional
scheduledbooleanOptional
scheduledEntryGuidstringOptional
entryTasknullOptional
taskIdstringOptional
playbookIdstringOptional
reputationSizeintegerOptional
contentsSizeintegerOptional
InstanceIDstringOptional
IndicatorTimelinenullOptional
RelationshipsnullOptional
mirroredbooleanOptional
post/xsoar/public/v1/investigation/{investigation_id}/close
POST /xsoar/public/v1/investigation/{investigation_id}/close HTTP/1.1
Host: api-yourfqdn
authorization: DCdIeow0xm73EwnxjPza1tdHTfZQv2eH7bTKlTPkgBHLj8aSjFzjgTE9bQUK1DidlWLrnYRhaYQ4PCIyNrNJbMUC6DOWi8ANIn1JWpMTE2neGvoDIRsKUbj6pJ1z7Gmr
x-xdr-auth-id: 2841
Content-Type: application/json
Accept: */*
Content-Length: 65

{
  "closeNotes": "just text",
  "closeReason": "Resolved - Known Issue"
}
200

OK

{
  "id": "reopen_inv_id@153461",
  "version": 0,
  "cacheVersn": 0,
  "modified": "0001-01-01T00:00:00Z",
  "sizeInBytes": 0,
  "type": 4,
  "created": "2024-04-14T10:23:34.402486009Z",
  "incidentCreationTime": "0001-01-01T00:00:00Z",
  "investigationCreationTime": "0001-01-01T00:00:00Z",
  "retryTime": "0001-01-01T00:00:00Z",
  "user": "",
  "errorSource": "",
  "contents": "153461",
  "format": "closedInv",
  "investigationId": "153461",
  "file": "",
  "fileID": "",
  "parentId": "",
  "pinned": false,
  "fileMetadata": null,
  "parentContent": null,
  "parentEntryTruncated": false,
  "system": "",
  "reputations": null,
  "category": "",
  "note": false,
  "isTodo": false,
  "tags": null,
  "tagsRaw": null,
  "startDate": "0001-01-01T00:00:00Z",
  "times": 0,
  "recurrent": false,
  "endingDate": "0001-01-01T00:00:00Z",
  "timezoneOffset": 0,
  "cronView": false,
  "scheduled": false,
  "scheduledEntryGuid": "",
  "entryTask": null,
  "taskId": "",
  "playbookId": "",
  "reputationSize": 0,
  "contentsSize": 0,
  "InstanceID": "",
  "IndicatorTimeline": null,
  "Relationships": null,
  "mirrored": false
}
PreviousIntegrations
NextJobs

Last updated

Was this helpful?