Create an Investigation

curl --request POST \
  --url http://investigations.{region}.alienvault.cloud/investigations/v3/investigations \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "title": "A weird error",
  "description": "I found this strange error in my logs. It could be serious.",
  "deployment": "cn://asecurityteam.alienvault.cloud",
  "severity": "Medium",
  "status": "Open",
  "intent": "Reconnaissance & Probing"
}
'

{
  "_links": {
    "self": {
      "href": "https://svc.alienvault.cloud/investigations/v3/investigations/2033c597-97d2-49f4-b3b6-c9079d46c0f2"
    },
    "attachments": {
      "href": "https://svc.alienvault.cloud/investigations/v3/investigations/2033c597-97d2-49f4-b3b6-c9079d46c0f2/attachments"
    },
    "evidence": {
      "href": "https://svc.alienvault.cloud/investigations/v3/investigations/2033c597-97d2-49f4-b3b6-c9079d46c0f2/evidence"
    },
    "history": {
      "href": "https://svc.alienvault.cloud/investigations/v3/investigations/2033c597-97d2-49f4-b3b6-c9079d46c0f2/history"
    },
    "notes": {
      "href": "https://svc.alienvault.cloud/investigations/v3/investigations/2033c597-97d2-49f4-b3b6-c9079d46c0f2/notes"
    }
  },
  "_embedded": {
    "attachments": {
      "elements": 1
    },
    "evidence": {
      "elements": 6
    },
    "notes": {
      "elements": 3
    },
    "history": {
      "elements": 21
    }
  },
  "id": "2033c597-97d2-49f4-b3b6-c9079d46c0f2",
  "i3": "INV-201811-22-0023",
  "title": "A weird error",
  "description": "I found this strange error in my logs. It could be serious.",
  "deployment": "cn://asecurityteam.alienvault.cloud",
  "private": false,
  "severity": "Medium",
  "intent": "Reconnaissance & Probing",
  "status": "Open",
  "assignedTo": "ace@some.mssp.com",
  "created": {
    "by": "user@asecurityteam.com",
    "on": "2018-11-07T15:38:52.132Z"
  },
  "lastModified": {
    "by": "user@asecurityteam.com",
    "on": "2018-11-07T15:38:52.132Z"
  }
}

{
  "errorId": "<string>",
  "message": "<string>",
  "variables": [
    "<string>"
  ],
  "errorUrl": "<string>"
}

POST

investigations

curl --request POST \
  --url http://investigations.{region}.alienvault.cloud/investigations/v3/investigations \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "title": "A weird error",
  "description": "I found this strange error in my logs. It could be serious.",
  "deployment": "cn://asecurityteam.alienvault.cloud",
  "severity": "Medium",
  "status": "Open",
  "intent": "Reconnaissance & Probing"
}
'

{
  "_links": {
    "self": {
      "href": "https://svc.alienvault.cloud/investigations/v3/investigations/2033c597-97d2-49f4-b3b6-c9079d46c0f2"
    },
    "attachments": {
      "href": "https://svc.alienvault.cloud/investigations/v3/investigations/2033c597-97d2-49f4-b3b6-c9079d46c0f2/attachments"
    },
    "evidence": {
      "href": "https://svc.alienvault.cloud/investigations/v3/investigations/2033c597-97d2-49f4-b3b6-c9079d46c0f2/evidence"
    },
    "history": {
      "href": "https://svc.alienvault.cloud/investigations/v3/investigations/2033c597-97d2-49f4-b3b6-c9079d46c0f2/history"
    },
    "notes": {
      "href": "https://svc.alienvault.cloud/investigations/v3/investigations/2033c597-97d2-49f4-b3b6-c9079d46c0f2/notes"
    }
  },
  "_embedded": {
    "attachments": {
      "elements": 1
    },
    "evidence": {
      "elements": 6
    },
    "notes": {
      "elements": 3
    },
    "history": {
      "elements": 21
    }
  },
  "id": "2033c597-97d2-49f4-b3b6-c9079d46c0f2",
  "i3": "INV-201811-22-0023",
  "title": "A weird error",
  "description": "I found this strange error in my logs. It could be serious.",
  "deployment": "cn://asecurityteam.alienvault.cloud",
  "private": false,
  "severity": "Medium",
  "intent": "Reconnaissance & Probing",
  "status": "Open",
  "assignedTo": "ace@some.mssp.com",
  "created": {
    "by": "user@asecurityteam.com",
    "on": "2018-11-07T15:38:52.132Z"
  },
  "lastModified": {
    "by": "user@asecurityteam.com",
    "on": "2018-11-07T15:38:52.132Z"
  }
}

{
  "errorId": "<string>",
  "message": "<string>",
  "variables": [
    "<string>"
  ],
  "errorUrl": "<string>"
}

Authorizations

Authorization

string

header

required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Headers

X-ATT-MessageId

string<uuid>

A client-provided value that uniquely identifies a client generated message sent to the service. This header will be reflected back unchanged in the response.

Body

application/json

The POST body is the Investigaiton object to create.

Creates a new investigation object.

title

string

required

Title of the investigation.

description

string

required

Description of the investigation.

deployment

string<uri>

required

URI of the USM Anywhere deployment.

status

enum<string>

required

Status of the investigation.

Available options:

Open,

In Review,

Closed

severity

enum<string>

required

Severity of the investigation.

Available options:

None,

Low,

Medium,

High,

Critical

intent

enum<string>

required

Intent of the investigation.

Available options:

Exploitation & Installation,

Delivery & Attack,

Reconnaissance & Probing,

Environmental Awareness

private

boolean

Specifies the visibility of the item. This semantic is only valid when there exists a relationship between a USM Central deployment and a USM Anywhere deployment. When set to true, only the users within the same deployment, USM Central or USM Anywhere, can see the item; the users from the other deployment cannot.

Response

CREATED

Returns an investigation.

_links

object

Show child attributes

_embedded

object

Show child attributes

string<uuid>

ID of the investigation.

string

Allows you to specify an alternative identifier for the investigation so that it is simple to integrate with your existing systems and processes.

title

string

Title of the investigation.

description

string

Description of the investigation.

deployment

string<uri>

URI of the USM Anywhere deployment.

private

boolean

status

enum<string>

Status of the investigation.

Available options:

Open,

In Review,

Closed

intent

enum<string>

Intent of the investigation.

Available options:

Exploitation & Installation,

Delivery & Attack,

Reconnaissance & Probing,

Environmental Awareness

severity

enum<string>

Severity of the investigation.

Available options:

None,

Low,

Medium,

High,

Critical

assignedTo

string<email>

Email of the user receiving the assignment.

created

_mod_on_by · object

Specifies when the resource was created and by whom.

Show child attributes

lastModified

lastModified · object

Specifies when the latest modification was made and by whom.

Show child attributes

⌘I