> ## Documentation Index
> Fetch the complete documentation index at: https://docs.blinkops.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Create Investigation

Create a new investigation, optionally attaching alerts, events and saved searches to it as genesis evidence.

> [!NOTE]
>
> External Documentation
>
> To learn more, visit the [Secureworks Taegis XDR documentation](https://docs.taegis.secureworks.com/apis/using_investigations_api/#create-an-investigation).

## Parameters

| Parameter | Description |
| - | - |
| Alerts | A comma-separated list of alert IDs to attach to the investigation. Can be obtained using the `Search Alerts` action. **Note:** Alerts attached on creation are considered genesis evidence. |
| Alerts Search Query | A CQL query used to attach alerts to the investigation in bulk. **For Example:** `FROM alert WHERE severity >= 0.6 AND status = 'OPEN' EARLIEST=-1d`f. |
| Assignee ID | The user to assign the investigation to. Must be a valid user ID, client ID or `@mention`. **For Example:** `@customer` or `@secureworks` |
| Events | A comma-separated list of event IDs to attach to the investigation. |
| Key Findings | The key findings explaining the details of the investigation. |
| Priority | Select the priority of the investigation. |
| Search Queries | A comma-separated list of saved searches to attach to the investigation. The searches themselves are attached, not their results. |
| Service Desk ID | An ID mapping a third-party service desk ticket to the investigation. May be a URL or any other identifier. **For Example:** `https://company.service-now.com//nav_to.do?uri=%2Fincident.do%3Fsys_id=3454676eadfedaf8e665370cbb350b&id=INC2345` |
| Service Desk Type | The service desk type used in relation to the `Service Desk ID`. Free form text that is not validated. **For Example:** `SNOW` |
| Status | Select the status of the investigation. |
| Tags | A comma-separated list of tags used to help label the investigation. |
| Title | The title of the investigation. Limited to `256` characters, anything longer is trimmed. |
| Type | Select the type to open the investigation as. The available types depend on your user and your tenant's service level. |

## Workflow Library Example

[Create Investigation with Secureworks Taegis Xdr and Send Results Via Email](https://library.blinkops.com/workflows/create-investigation-with-secureworks-taegis-xdr-and-send-results-via-email)

![Workflow Library](https://mintcdn.com/blinkops-2/ojHYuDeYX5FWuN8a/img/Icons/play-box.svg?fit=max\&auto=format\&n=ojHYuDeYX5FWuN8a\&q=85\&s=b8af968e71438a9499c3223c9bd29fb2)

Preview this Workflow on desktop

[https://library.blinkops.com/workflows/create-investigation-with-secureworks-taegis-xdr-and-send-results-via-email/canvas](https://library.blinkops.com/workflows/create-investigation-with-secureworks-taegis-xdr-and-send-results-via-email/canvas)