Search Investigations

Search for investigations.

External Documentation

To learn more, visit the Rapid7 InsightIDR documentation.

​

Basic Parameters

Parameter	Description
End Time	The end of the timeframe to filter the results by.
Page	The number of the page to return results from (zero-based).
Page Size	The maximum number of results to return per page. Valid range is 1-100
Return All Pages	Automatically fetch all resources, page by page.
Search	An array of searching objects to filter the results by. For example: [ { “field”: “title”, “operator”: “EQUALS,CONTAINS,IN”, “value”: { } #Could be a value of any type. } ] For more information about optional searching fields, please refer to - Rapid7 Insight IDR Documentation
Sort	An array of sorting criteria. For Example: [ { “field”: “name”, “order”: “ASC” } ] For more information about optional sorting fields, please refer to - Rapid7 Insight IDR Documentation
Start Time	The start of the timeframe to filter the results by.

​

Advanced Parameters

Parameter	Description
Multi Customer	When selected, investigations will be returned from all organizations the connected user has access to. Note: This feature is available for multi-customer user keys only.

​

Example Output

{
	"search": [
		{
			"field": "name",
			"operator": "EQUALS,CONTAINS,IN",
			"value": {}
		}
	],
	"sort": [
		{
			"field": "name",
			"order": "ASC"
		}
	],
	"start_time": "2018-07-04T00:00:00Z",
	"end_time": "2018-07-04T00:00:00Z"
}