> ## Documentation Index
> Fetch the complete documentation index at: https://docs.blinkops.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Search Investigations

Search investigations using the Taegis XDR Query Language (CQL).

> [!NOTE]
>
> External Documentation
>
> To learn more, visit the [Secureworks Taegis XDR documentation](https://docs.taegis.secureworks.com/apis/using_investigations_api/#search-investigations).

## Parameters

| Parameter | Description |
| - | - |
| CQL Query | The Taegis XDR Query Language (CQL) query to search the investigations by. **For Example:** `status IN ('Open', 'Awaiting Action') and createdAt >= '2024-07-19T21:55:28.163531Z'` **Note:** Aggregations, `HEAD`, `TAIL` and joins are not supported. Use `Page` and `Per Page` to paginate, and a `\| sort by` clause to order the results.\| |
| Page | The page of results to return. Pages start at `1`. |
| Per Page | The maximum number of investigations to return per page. Defaults to `100`. |
| Return All Pages | Automatically fetch all resources, page by page. |
| Tenant Service Filters | A comma-separated list of the tenant service labels to filter the investigations by. |

## Workflow Library Example

[Search Investigations with Secureworks Taegis Xdr and Send Results Via Email](https://library.blinkops.com/workflows/search-investigations-with-secureworks-taegis-xdr-and-send-results-via-email)

![Workflow Library](https://mintcdn.com/blinkops-2/ojHYuDeYX5FWuN8a/img/Icons/play-box.svg?fit=max\&auto=format\&n=ojHYuDeYX5FWuN8a\&q=85\&s=b8af968e71438a9499c3223c9bd29fb2)

Preview this Workflow on desktop

[https://library.blinkops.com/workflows/search-investigations-with-secureworks-taegis-xdr-and-send-results-via-email/canvas](https://library.blinkops.com/workflows/search-investigations-with-secureworks-taegis-xdr-and-send-results-via-email/canvas)