---
title: "Count Bits Security Analyst investigations"
method: GET
path: "/api/v2/security_monitoring/security_agent/investigations/count"
tags: ["Bits Security Analyst"]
---

# Count Bits Security Analyst investigations

`GET /api/v2/security_monitoring/security_agent/investigations/count`

## Request

- Base URL: `https://api.datadoghq.com`
- URL: `https://api.datadoghq.com/api/v2/security_monitoring/security_agent/investigations/count`
- Auth: one of:
  - API key in header `DD-API-KEY` and API key in header `DD-APPLICATION-KEY`
  - OAuth 2
    - Authorization code: `/oauth2/v1/authorize`
    - Token URL: `/oauth2/v1/token` scopes: `security_monitoring_signals_read`
- TypeScript: <https://skmtc.dev/datadog/apis/datadog-api-v2-collection/docs/api/v2/security_monitoring/security_agent/investigations/count/get.ts> (a function with typed inputs; its response is checked against the schema)

Count completed Bits Security Analyst investigations by the values of one field. Buckets are sorted by
ascending count. With `field=entity` or `field=signal_source`, an investigation counts in the bucket of
each of its entities or sources.

## Query parameters

- `field` 'verdict' | 'rule_type' | 'signal_source' | 'entity', required: Field to count completed investigations by.
- `filter[title]` string
- `filter[from]` string
- `filter[to]` string
- `filter[verdict]` string
- `filter[rule_id]` string
- `filter[rule_type]` string
- `filter[signal_severity]` string
- `filter[signal_source]` string
- `filter[tags]` string
- `filter[entity]` string

## Response `200`

OK

- SecurityAgentInvestigationCountsResponse: Completed investigations counted by the values of one field.
  - `data` SecurityAgentInvestigationCountsData, required: Counts of completed investigations.
    - `attributes` SecurityAgentInvestigationCountsAttributes, required: The counts of each value of the field.
      - `counts` SecurityAgentInvestigationCount[], required: One bucket per value, sorted by ascending count.
        - `count` integer, required: Number of completed investigations with this value.
        - `value` string, required: A value of the counted field.
    - `id` string, required: The counted field.
    - `type` 'investigation_counts', required: Type of the investigation counts resource.

## Other responses

- `400`: Bad Request
- `403`: Forbidden
- `429`: Too many requests

---

[API](https://skmtc.dev/datadog/apis/datadog-api-v2-collection.md) - [All operations](https://skmtc.dev/datadog/apis/datadog-api-v2-collection/llms.txt) - [OpenAPI document](https://skmtc.dev/datadog/apis/datadog-api-v2-collection/revisions/3f70db624329?raw)