> ## Documentation Index
> Fetch the complete documentation index at: https://docs.blinkops.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Add Evidence To Investigation

Add alerts, events and saved searches as evidence to an existing investigation.

> [!NOTE]
>
> External Documentation
>
> To learn more, visit the [Secureworks Taegis XDR documentation](https://docs.taegis.secureworks.com/apis/using_investigations_api/#add-additional-evidence-to-an-investigation).

## Parameters

| Parameter | Description |
| - | - |
| Alerts | A comma-separated list of alert IDs to attach to the investigation. Can be obtained using the `Search Alerts` action. **For Example:** `alert://priv:stolen-user-credentials:11772:1723482198701:9640c014-cd59-448d-b47d-aa8e8e3747fe` |
| Alerts Search Query | A CQL query used to add alerts to the investigation in bulk. **For Example:** `FROM alert WHERE severity >= 0.6 AND status = 'OPEN' EARLIEST=-1d` |
| Events | A comma-separated list of event IDs to attach to the investigation. **For Example:** `event://priv:scwx.auth:11772:1708626661995:422496f6-a491-4983-af90-020a4b46a0e8` |
| Investigation ID | The ID of the investigation to add the evidence to. Can be obtained using the `Search Investigations` action. **For Example:** `d638e49d-a3b5-421e-b28d-cb9322a5eaa6` |
| Search Queries | A comma-separated list of saved searches to attach to the investigation. The searches themselves are attached, not their results. |

## Workflow Library Example

[Add Evidence to Investigation with Secureworks Taegis Xdr and Send Results Via Email](https://library.blinkops.com/workflows/add-evidence-to-investigation-with-secureworks-taegis-xdr-and-send-results-via-email)

![Workflow Library](https://mintcdn.com/blinkops-2/ojHYuDeYX5FWuN8a/img/Icons/play-box.svg?fit=max\&auto=format\&n=ojHYuDeYX5FWuN8a\&q=85\&s=b8af968e71438a9499c3223c9bd29fb2)

Preview this Workflow on desktop

[https://library.blinkops.com/workflows/add-evidence-to-investigation-with-secureworks-taegis-xdr-and-send-results-via-email/canvas](https://library.blinkops.com/workflows/add-evidence-to-investigation-with-secureworks-taegis-xdr-and-send-results-via-email/canvas)