investigations

Creates, updates, deletes, gets or lists an investigations resource.

Overview

Name	investigations
Type	Resource
Id	aws.security_ir.investigations

Fields

The following fields are returned by SELECT queries:

list_investigations

Name	Datatype	Description
action_type	string	The type of investigation action being performed. This categorizes the investigation method or approach used in the case. (Evidence, Investigation, Summarization)
content	string	Detailed investigation results in rich markdown format. This field contains the comprehensive findings, analysis, and conclusions from the investigation.
feedback	object	User feedback for this investigation result. This contains the user's assessment and comments about the quality and usefulness of the investigation findings.
investigation_id	string	The unique identifier for this investigation action. This ID is used to track and reference the specific investigation throughout its lifecycle. (pattern: <code>inv-[a-z0-9]{10,32}</code>)
last_updated	string (date-time)	ISO 8601 timestamp of the most recent status update. This indicates when the investigation was last modified or when its status last changed.
status	string	The current execution status of the investigation. This indicates whether the investigation is pending, in progress, completed, or failed. (Pending, InProgress, Waiting, Completed, Failed, Cancelled)
title_	string	Human-readable summary of the investigation focus. This provides a brief description of what the investigation is examining or analyzing.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
list_investigations	select	case_id, region	nextToken, maxResults	Investigation performed by an agent for a security incident...

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
case_id	string	Investigation performed by an agent for a security incident per caseID
region	string	AWS region (default: us-east-1)
maxResults	integer	Investigation performed by an agent for a security incident request, returning max results
nextToken	string	Investigation performed by an agent for a security incident request

SELECT examples

list_investigations

Investigation performed by an agent for a security incident...

SELECT
action_type,
content,
feedback,
investigation_id,
last_updated,
status,
title_
FROM aws.security_ir.investigations
WHERE case_id = '{{ case_id }}' -- required
AND region = '{{ region }}' -- required
AND nextToken = '{{ nextToken }}'
AND maxResults = '{{ maxResults }}'
;