Skip to main content
GET
Obtain an Investigation

Authorizations

Authorization
string
header
required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Headers

X-ATT-MessageId
string<uuid>

A client-provided value that uniquely identifies a client generated message sent to the service. This header will be reflected back unchanged in the response.

Path Parameters

investigationId
string<uuid>
required

The unique identifier of an investigation.

Response

OK

Returns an investigation.

_embedded
object
id
string<uuid>

ID of the investigation.

i3
string

Allows you to specify an alternative identifier for the investigation so that it is simple to integrate with your existing systems and processes.

title
string

Title of the investigation.

description
string

Description of the investigation.

deployment
string<uri>

URI of the USM Anywhere deployment.

private
boolean

Specifies the visibility of the item. This semantic is only valid when there exists a relationship between a USM Central deployment and a USM Anywhere deployment. When set to true, only the users within the same deployment, USM Central or USM Anywhere, can see the item; the users from the other deployment cannot.

status
enum<string>

Status of the investigation.

Available options:
Open,
In Review,
Closed
intent
enum<string>

Intent of the investigation.

Available options:
Exploitation & Installation,
Delivery & Attack,
Reconnaissance & Probing,
Environmental Awareness
severity
enum<string>

Severity of the investigation.

Available options:
None,
Low,
Medium,
High,
Critical
assignedTo
string<email>

Email of the user receiving the assignment.

created
_mod_on_by · object

Specifies when the resource was created and by whom.

lastModified
lastModified · object

Specifies when the latest modification was made and by whom.