DAdatadog
Bits Security Analyst

Count Bits Security Analyst investigations

Count completed Bits Security Analyst investigations by the values of one field. Buckets are sorted by ascending count. With field=entity or field=signal_source, an investigation counts in the bucket of each of its entities or sources.

get/api/v2/security_monitoring/security_agent/investigations/count

Request

Query parameters

field'verdict' | 'rule_type' | 'signal_source' | 'entity' required

Field to count completed investigations by.

Example:verdict
filter[title]string

Only investigations whose signal title contains this text, case-insensitive.

filter[from]string

Only investigations last updated at or after this time, as RFC 3339 or milliseconds since the epoch.

filter[to]string

Only investigations last updated at or before this time, as RFC 3339 or milliseconds since the epoch.

filter[verdict]string

Only investigations with one of these verdicts: benign, suspicious, or malicious. Comma-separated values; an investigation matches any of them.

filter[rule_id]string

Only investigations of signals from one of these detection rule IDs. Comma-separated values; an investigation matches any of them.

filter[rule_type]string

Only investigations of signals from detection rules of one of these types, as returned by the count with field=rule_type. Comma-separated values; an investigation matches any of them.

filter[signal_severity]string

Only investigations of signals with one of these severities: info, low, medium, high, or critical. Comma-separated values; an investigation matches any of them.

filter[signal_source]string

Only investigations of signals from one of these sources, as returned by the count with field=signal_source. Comma-separated values; an investigation matches any of them.

filter[tags]string

Only investigations whose signal has all of these tags, written key:value. Comma-separated values; an investigation must have every one of them.

filter[entity]string

Only investigations whose signal has all of these entities. Write each entity as attribute:value, matching the values returned by the count endpoint with field=entity. Comma-separated values; an investigation must have every one of them.

Response

OK

Example response

{
  "data": {
    "attributes": {
      "counts": [
        {
          "count": 1250,
          "value": "benign"
        }
      ]
    },
    "id": "verdict",
    "type": "investigation_counts"
  }
}

Changes

Changes to this operation have not been checked yet.