DAdatadog
Bits Security Analyst

List Bits Security Analyst investigations

List Bits Security Analyst investigations.

Without filter[signal_id], returns the latest investigation of each signal, filtered, sorted, and paginated. With filter[signal_id], returns every investigation of that signal, newest first. When the signal has no investigation, the first page carries meta.reason, which says why.

get/api/v2/security_monitoring/security_agent/investigations

Request

Query parameters

filter[signal_id]string

List every investigation of this signal, newest first. Accepts the signal ID in its V1 form, which starts with AQ, or in its longer V3 form, which starts with Aw. Investigations carry the V1 form, so their signal_id can differ from the ID you pass. Can't be combined with other filters or with sort.

filter[title]string

Only investigations whose signal title contains this text, case-insensitive.

filter[from]string

Only investigations last updated at or after this time, as RFC 3339 or milliseconds since the epoch.

filter[to]string

Only investigations last updated at or before this time, as RFC 3339 or milliseconds since the epoch.

filter[verdict]string

Only investigations with one of these verdicts: benign, suspicious, or malicious. Comma-separated values; an investigation matches any of them.

filter[state]string

Only investigations in one of these states: investigating or completed. Investigations reported as failed match investigating. Comma-separated values; an investigation matches any of them.

filter[rule_id]string

Only investigations of signals from one of these detection rule IDs. Comma-separated values; an investigation matches any of them.

filter[rule_type]string

Only investigations of signals from detection rules of one of these types, as returned by the count with field=rule_type. Comma-separated values; an investigation matches any of them.

filter[signal_severity]string

Only investigations of signals with one of these severities: info, low, medium, high, or critical. Comma-separated values; an investigation matches any of them.

filter[signal_source]string

Only investigations of signals from one of these sources, as returned by the count with field=signal_source. Comma-separated values; an investigation matches any of them.

filter[tags]string

Only investigations whose signal has all of these tags, written key:value. Comma-separated values; an investigation must have every one of them.

filter[entity]string

Only investigations whose signal has all of these entities. Write each entity as attribute:value, matching the values returned by the count endpoint with field=entity. Comma-separated values; an investigation must have every one of them.

sortstring

Sort field, prefixed with - for descending: updated_at, severity, verdict, rule_id, or signal_title. Defaults to -updated_at. verdict sorts by severity (benign, suspicious, malicious), so -verdict puts malicious first.

page[number]integer

Page number, starting at 1.

page[size]integer

Number of investigations per page.

Response

OK

Example response

{
  "data": [
    {
      "attributes": {
        "created_at": "2026-10-30T14:02:40Z",
        "is_latest": true,
        "rule_id": "abc-def-ghi",
        "signal": {
          "severity": "medium",
          "sources": [
            "okta"
          ],
          "tactic": "TA0001-initial-access",
          "tags": [
            "source:okta"
          ],
          "technique": "T1078-valid-accounts",
          "timestamp": "2026-10-30T14:02:11Z",
          "title": "Unusual login location for a user"
        },
        "signal_id": "AQAAAaGNHjq4XzqcIQAAAABBWm8xY0wybUFBQmNYSjl1QUFBQUFBQUE",
        "state": "completed",
        "updated_at": "2026-10-30T14:15:02Z",
        "verdict": "benign"
      },
      "id": "7f3c9a2e-5d14-4e8b-9c61-2a0b4f8d1e53",
      "type": "investigations"
    }
  ],
  "meta": {
    "reason": "investigation_not_started",
    "total_count": 1
  }
}

Changes

Changes to this operation have not been checked yet.