--- title: SecureWorks Taegis XDR slug: connectors/secureworks-taegis-xdr docTags: createdAt: 2026-06-09T16:29:44.142Z --- The SecureWorks Taegis XDR connector allows for seamless integration with Swimlane, enabling automated threat detection and response workflows. SecureWorks Taegis XDR is an advanced threat detection and response platform that provides comprehensive visibility and analysis across an organization's digital environment. This connector enables Swimlane Turbine users to automate critical security operations tasks, such as aggregating and resolving alerts, managing assets, and conducting investigations within Taegis XDR. By integrating with SecureWorks Taegis XDR, users can streamline incident response, enhance asset management, and accelerate investigation processes, all from within the Swimlane Turbine platform. The connector's actions are designed to facilitate efficient security automation, allowing users to focus on strategic decision-making and threat mitigation. ## Prerequisites To effectively utilize the SecureWorks Taegis XDR connector with Swimlane, ensure you have the following prerequisites: - OAuth 2.0 client credentials for authentication with the following parameters: - URL: Endpoint URL for SecureWorks Taegis XDR API access. - Client ID: Unique identifier for the application making the request. - Client Secret: A secret key provided by SecureWorks Taegis XDR to authenticate the application. ## Asset Setup To obtain the required asset paramaters - host, client\_id, client\_secret, see [https://docs.ctpx.secureworks.com/apis/using\_xdr\_apis/](https://docs.ctpx.secureworks.com/apis/using_xdr_apis/). ## Tasks Setup For all the specific actions all that is needed are the same variables for the matching query/mutation, and for the "Run Generic Query" action the whole GraphQL query needs to be provided. # Configurations ## Oauth 2.0 Client Credentials Authenticates using oauth 2.0 client credentials ### Configuration Parameters | **Parameter** | **Description** | **Type** | **Required** | | -------------- | ---------------------------------- | -------- | ------------ | | url | A URL to the target host. | string | Required | | client\_id | The client ID | string | Required | | client\_secret | The client secret. | string | Required | | scope | Permission scopes for this action. | array | Optional | | verify\_ssl | Verify SSL certificate | boolean | Optional | | http\_proxy | A proxy to route requests through. | string | Optional | # Actions ## Aggregate alerts Compiles alerts based on a specified CQL query in SecureWorks Taegis XDR, facilitating streamlined alert management. ### Endpoint - **URL:** `graphql` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | -------------------------------------- | | `cql_query` | string | Required | query used to filter alerts | | `limit` | number | Optional | maximum number of alerts to retrieve | | `offset` | number | Optional | offset to start retrieving alerts from | ### Input Example `{"cql_query":"string","limit":500,"offset":123}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------------------ | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | object | Response data | | `data.alertsServiceSearch` | object | Response data | | `data.alertsServiceSearch.alerts` | object | Response data | | `data.alertsServiceSearch.alerts.group_by` | array | Response data | | `data.alertsServiceSearch.alerts.group_by.key` | string | Response data | | `data.alertsServiceSearch.alerts.group_by.value` | number | Response data | | `data.alertsServiceSearch.alerts.total_results` | number | Response data | | `data.alertsServiceSearch.reason` | string | Response data | | `data.alertsServiceSearch.status` | string | Response data | ### Output Example `{"status_code":200,"response_headers":{"Date":"Thu, 01 Dec 2022 18:27:19 GMT","Content-Type":"application/json","Content-Length":"443","Connection":"keep-alive","Access-Control-Allow-Credentials":"true","Access-Control-Allow-Headers":"Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, X-Tenant-Context, C...","Access-Control-Allow-Methods":"","Access-Control-Allow-Origin":"api.delta.taegis.secureworks.com","Access-Control-Expose-Headers":"link","Access-Control-Request-Method":"","Cache-...` ## Delete assets Removes specified assets from SecureWorks Taegis XDR using a list of asset IDs provided by the user. ### Endpoint - **URL:** `graphql` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | --------------------------------------- | | `asset_ids` | array | Required | list of ids of the assets to be deleted | ### Input Example `{"asset_ids":["string"]}` ## Get Alerts Fetches alerts from SecureWorks Taegis XDR using a specified CQL query filter to streamline incident response. ### Endpoint - **URL:** `graphql` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | -------------------------------------- | | `cql_query` | string | Required | query used to filter alerts | | `limit` | number | Optional | maximum number of alerts to retrieve | | `offset` | number | Optional | offset to start retrieving alerts from | ### Input Example `{"cql_query":"string","limit":500,"offset":123}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | object | Response data | | `data.alertsServiceSearch` | object | Response data | | `data.alertsServiceSearch.alerts` | object | Response data | | `data.alertsServiceSearch.alerts.list` | array | Response data | | `data.alertsServiceSearch.alerts.list.attack_technique_ids` | array | Response data | | `data.alertsServiceSearch.alerts.list.entities` | object | Response data | | `data.alertsServiceSearch.alerts.list.id` | string | Response data | | `data.alertsServiceSearch.alerts.list.investigation_ids` | array | Response data | | `data.alertsServiceSearch.alerts.list.metadata` | object | Response data | | `data.alertsServiceSearch.alerts.list.resolution_reason` | string | Response data | | `data.alertsServiceSearch.alerts.list.sensor_types` | array | Response data | | `data.alertsServiceSearch.alerts.list.status` | string | Response data | | `data.alertsServiceSearch.alerts.list.suppressed` | boolean | Response data | | `data.alertsServiceSearch.alerts.list.suppression_rules` | object | Response data | | `data.alertsServiceSearch.alerts.list.tenant_id` | string | Response data | | `data.alertsServiceSearch.alerts.total_results` | number | Response data | | `data.alertsServiceSearch.reason` | string | Response data | | `data.alertsServiceSearch.status` | string | Response data | ### Output Example `{"status_code":200,"response_headers":{"Date":"Thu, 01 Dec 2022 18:53:34 GMT","Content-Type":"application/json","Transfer-Encoding":"chunked","Connection":"keep-alive","Access-Control-Allow-Credentials":"true","Access-Control-Allow-Headers":"Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, X-Tenant-Context, C...","Access-Control-Allow-Methods":"","Access-Control-Allow-Origin":"api.delta.taegis.secureworks.com","Access-Control-Expose-Headers":"link","Access-Control-Request-Method":"",...` ## Get Assets Retrieves a list of assets from SecureWorks Taegis XDR based on the provided CQL query. ### Endpoint - **URL:** `graphql` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | -------------------------------------- | | `order_by` | string | Optional | key to order by | | `filter_asset_state` | string | Optional | asset state filter | | `limit` | number | Optional | maximum number of alerts to retrieve | | `offset` | number | Optional | offset to start retrieving alerts from | ### Input Example `{"order_by":"string","filter_asset_state":"string","limit":500,"offset":123}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------------ | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | object | Response data | | `data.allAssets` | object | Response data | | `data.allAssets.assets` | array | Response data | | `data.allAssets.assets.endpointType` | string | Response data | | `data.allAssets.assets.hostId` | string | Response data | | `data.allAssets.assets.hostnames` | array | Response data | | `data.allAssets.assets.hostnames.hostname` | string | Response data | | `data.allAssets.assets.id` | string | Response data | | `data.allAssets.assets.osVersion` | string | Response data | | `data.allAssets.assets.sensorId` | string | Response data | | `data.allAssets.assets.sensorTenant` | string | Response data | | `data.allAssets.assets.sensorVersion` | string | Response data | | `data.allAssets.totalResults` | number | Response data | ### Output Example `{"status_code":200,"response_headers":{"Date":"Thu, 01 Dec 2022 18:50:36 GMT","Content-Type":"application/json","Content-Length":"650","Connection":"keep-alive","Access-Control-Allow-Credentials":"true","Access-Control-Allow-Headers":"Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, X-Tenant-Context, C...","Access-Control-Allow-Methods":"","Access-Control-Allow-Origin":"api.delta.taegis.secureworks.com","Access-Control-Expose-Headers":"link","Access-Control-Request-Method":"","Cache-...` ## Get Investigation Alerts Retrieve alerts associated with a specific investigation ID in SecureWorks Taegis XDR. ### Endpoint - **URL:** `graphql` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------ | -------- | ------------ | -------------------------------------- | | `investigation_id` | string | Required | Unique identifier | | `page` | number | Optional | Parameter for Get Investigation Alerts | | `per_page` | number | Optional | Parameter for Get Investigation Alerts | | `filter_query` | string | Optional | Parameter for Get Investigation Alerts | | `order_by_field` | string | Optional | Parameter for Get Investigation Alerts | | `order_direction` | string | Optional | Parameter for Get Investigation Alerts | ### Input Example `{"investigation_id":"string","page":123,"per_page":123,"filter_query":"string","order_by_field":"string","order_direction":"string"}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | object | Response data | | `data.investigationAlerts` | object | Response data | | `data.investigationAlerts.alerts` | array | Response data | | `data.investigationAlerts.alerts.id` | string | Response data | | `data.investigationAlerts.alerts2` | array | Response data | | `data.investigationAlerts.alerts2.id` | string | Response data | | `data.investigationAlerts.totalCount` | number | Response data | ### Output Example `{"status_code":200,"response_headers":{"Date":"Thu, 01 Dec 2022 20:03:46 GMT","Content-Type":"application/json","Content-Length":"164","Connection":"keep-alive","Access-Control-Allow-Credentials":"true","Access-Control-Allow-Headers":"Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, X-Tenant-Context, C...","Access-Control-Allow-Methods":"","Access-Control-Allow-Origin":"api.delta.taegis.secureworks.com","Access-Control-Expose-Headers":"link","Access-Control-Request-Method":"","Cache-...` ## Get Investigation Assets Retrieve assets associated with a specific investigation in SecureWorks Taegis XDR using the provided investigation ID. ### Endpoint - **URL:** `graphql` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------ | -------- | ------------ | -------------------------------------- | | `investigation_id` | string | Required | Unique identifier | | `page` | number | Optional | Parameter for Get Investigation Assets | | `per_page` | number | Optional | Parameter for Get Investigation Assets | ### Input Example `{"investigation_id":"string","page":123,"per_page":123}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | object | Response data | | `data.investigationAssets` | object | Response data | | `data.investigationAssets.assets` | array | Response data | | `data.investigationAssets.assets.id` | string | Response data | | `data.investigationAssets.totalCount` | number | Response data | ### Output Example `{"status_code":200,"response_headers":{"Date":"Thu, 01 Dec 2022 20:13:14 GMT","Content-Type":"application/json","Content-Length":"106","Connection":"keep-alive","Access-Control-Allow-Credentials":"true","Access-Control-Allow-Headers":"Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, X-Tenant-Context, C...","Access-Control-Allow-Methods":"","Access-Control-Allow-Origin":"api.delta.taegis.secureworks.com","Access-Control-Expose-Headers":"link","Access-Control-Request-Method":"","Cache-...` ## Get Investigation Events Retrieve event details associated with a specific investigation ID in SecureWorks Taegis XDR. ### Endpoint - **URL:** `graphql` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------ | -------- | ------------ | -------------------------------------- | | `investigation_id` | string | Required | Unique identifier | | `page` | number | Optional | Parameter for Get Investigation Events | | `per_page` | number | Optional | Parameter for Get Investigation Events | ### Input Example `{"investigation_id":"string","page":123,"per_page":123}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | object | Response data | | `data.investigationEvents` | object | Response data | | `data.investigationEvents.events` | array | Response data | | `data.investigationEvents.events.file_name` | string | Response data | | `data.investigationEvents.events.file` | string | Response data | | `data.investigationEvents.totalCount` | number | Response data | ### Output Example `{"status_code":200,"response_headers":{"Date":"Thu, 01 Dec 2022 20:10:35 GMT","Content-Type":"application/json","Content-Length":"61","Connection":"keep-alive","Access-Control-Allow-Credentials":"true","Access-Control-Allow-Headers":"Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, X-Tenant-Context, C...","Access-Control-Allow-Methods":"","Access-Control-Allow-Origin":"api.delta.taegis.secureworks.com","Access-Control-Expose-Headers":"link","Access-Control-Request-Method":"","Cache-C...` ## Get Investigation Files Retrieve all files associated with a given investigation ID in SecureWorks Taegis XDR. ### Endpoint - **URL:** `graphql` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------ | -------- | ------------ | ----------------- | | `investigation_id` | string | Required | Unique identifier | ### Input Example `{"investigation_id":"string"}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | object | Response data | | `data.investigationFiles` | array | Response data | | `data.investigationFiles.file_name` | string | Response data | | `data.investigationFiles.file` | string | Response data | ### Output Example `{"status_code":200,"response_headers":{"Date":"Thu, 01 Dec 2022 20:18:24 GMT","Content-Type":"application/json","Content-Length":"34","Connection":"keep-alive","Access-Control-Allow-Credentials":"true","Access-Control-Allow-Headers":"Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, X-Tenant-Context, C...","Access-Control-Allow-Methods":"","Access-Control-Allow-Origin":"api.delta.taegis.secureworks.com","Access-Control-Expose-Headers":"link","Access-Control-Request-Method":"","Cache-C...` ## Get Investigation Status Summary Retrieve a summary of the current investigation status within SecureWorks Taegis XDR. ### Endpoint - **URL:** `graphql` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | --------------------- | | `updated_after` | string | Optional | timestamp filter from | | `updated_before` | string | Optional | timestamp filter to | ### Input Example `{"updated_after":"string","updated_before":"string"}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | object | Response data | | `data.investigationStatusSummary` | array | Response data | | `data.investigationStatusSummary.count` | number | Response data | | `data.investigationStatusSummary.date` | string | Response data | | `data.investigationStatusSummary.status` | string | Response data | ### Output Example `{"status_code":200,"response_headers":{"Date":"Thu, 01 Dec 2022 19:51:49 GMT","Content-Type":"application/json","Content-Length":"89","Connection":"keep-alive","Access-Control-Allow-Credentials":"true","Access-Control-Allow-Headers":"Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, X-Tenant-Context, C...","Access-Control-Allow-Methods":"","Access-Control-Allow-Origin":"api.delta.taegis.secureworks.com","Access-Control-Expose-Headers":"link","Access-Control-Request-Method":"","Cache-C...` ## Get Investigations Fetches a list of current investigations from SecureWorks Taegis XDR for further analysis or tracking. ### Endpoint - **URL:** `graphql` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | ------------------------------------- | | `cql_query` | string | Optional | query used to filter alerts | | `page` | number | Optional | page to retrieve | | `per_page` | number | Optional | how many records to retrieve per page | | `filter_text` | string | Optional | text to use for free text search | | `order_by_field` | string | Optional | field to order by | | `order_direction` | string | Optional | direction to order | ### Input Example `{"cql_query":"string","page":1,"per_page":100,"filter_text":"string","order_by_field":"string","order_direction":"string"}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | object | Response data | | `data.investigationsSearch` | object | Response data | | `data.investigationsSearch.investigations` | array | Response data | | `data.investigationsSearch.investigations.alerts` | array | Response data | | `data.investigationsSearch.investigations.alerts.file_name` | string | Response data | | `data.investigationsSearch.investigations.alerts.file` | string | Response data | | `data.investigationsSearch.investigations.assets` | array | Response data | | `data.investigationsSearch.investigations.assets.file_name` | string | Response data | | `data.investigationsSearch.investigations.assets.file` | string | Response data | | `data.investigationsSearch.investigations.created_at` | string | Response data | | `data.investigationsSearch.investigations.events` | array | Response data | | `data.investigationsSearch.investigations.events.file_name` | string | Response data | | `data.investigationsSearch.investigations.events.file` | string | Response data | | `data.investigationsSearch.investigations.files_count` | object | Response data | | `data.investigationsSearch.investigations.id` | string | Response data | | `data.investigationsSearch.investigations.status` | string | Response data | | `data.investigationsSearch.investigations.tags` | array | Response data | | `data.investigationsSearch.investigations.tags.file_name` | string | Response data | | `data.investigationsSearch.investigations.tags.file` | string | Response data | | `data.investigationsSearch.investigations.tenant_id` | string | Response data | | `data.investigationsSearch.investigations.updated_at` | string | Response data | | `data.investigationsSearch.totalCount` | number | Response data | ### Output Example `{"status_code":200,"response_headers":{"Date":"Thu, 01 Dec 2022 20:19:57 GMT","Content-Type":"application/json","Content-Length":"522","Connection":"keep-alive","Access-Control-Allow-Credentials":"true","Access-Control-Allow-Headers":"Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, X-Tenant-Context, C...","Access-Control-Allow-Methods":"","Access-Control-Allow-Origin":"api.delta.taegis.secureworks.com","Access-Control-Expose-Headers":"link","Access-Control-Request-Method":"","Cache-...` ## Isolate Asset Isolates a specified asset in SecureWorks Taegis XDR using the asset's ID and a provided reason for isolation. ### Endpoint - **URL:** `graphql` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | ------------------------------------------ | | `asset_id` | string | Required | id of the asset to isolate | | `reason` | string | Required | reason for why the asset is being isolated | ### Input Example `{"asset_id":"string"}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | object | Response data | | `data.isolateAsset` | object | Response data | | `data.isolateAsset.id` | string | Response data | | `data.isolateAsset.updatedAt` | string | Response data | ### Output Example `{"status_code":200,"response_headers":{"Date":"Thu, 01 Dec 2022 19:05:23 GMT","Content-Type":"application/json","Content-Length":"113","Connection":"keep-alive","Access-Control-Allow-Credentials":"true","Access-Control-Allow-Headers":"Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, X-Tenant-Context, C...","Access-Control-Allow-Methods":"","Access-Control-Allow-Origin":"api.delta.taegis.secureworks.com","Access-Control-Expose-Headers":"link","Access-Control-Request-Method":"","Cache-...` ## Resolve alerts Resolves specified alerts in SecureWorks Taegis XDR by their unique identifiers. ### Endpoint - **URL:** `graphql` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------- | -------- | ------------ | ---------------------------------------- | | `alert_ids` | array | Optional | list of ids of the alerts to be resolved | | `reason` | string | Optional | Response reason phrase | | `resolution_status` | string | Optional | Status value | ### Input Example `{"alert_ids":["string"],"resolution_status":"active"}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | object | Response data | | `data.alertsServiceUpdateResolutionInfo` | object | Response data | | `data.alertsServiceUpdateResolutionInfo.reason` | string | Response data | | `data.alertsServiceUpdateResolutionInfo.resolution_status` | string | Response data | ### Output Example `{"status_code":200,"response_headers":{"Date":"Thu, 01 Dec 2022 18:52:12 GMT","Content-Type":"application/json","Content-Length":"127","Connection":"keep-alive","Access-Control-Allow-Credentials":"true","Access-Control-Allow-Headers":"Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, X-Tenant-Context, C...","Access-Control-Allow-Methods":"","Access-Control-Allow-Origin":"api.delta.taegis.secureworks.com","Access-Control-Expose-Headers":"link","Access-Control-Request-Method":"","Cache-...` ## Run Generic Query Executes a specified query within SecureWorks Taegis XDR and returns the results. ### Endpoint - **URL:** `graphql` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | ------------------------------- | | `query` | string | Required | Parameter for Run Generic Query | ### Input Example `{"query":"string"}` ## Update Investigation Updates an existing investigation in SecureWorks Taegis XDR using the specified investigation ID and details. ### Endpoint - **URL:** `graphql` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------------------- | -------- | ------------ | ---------------------------------- | | `investigation_id` | string | Required | Unique identifier | | `investigation` | object | Required | Parameter for Update Investigation | | `investigation.tags` | array | Optional | Parameter for Update Investigation | | `investigation.genesis_alerts` | array | Optional | Parameter for Update Investigation | | `investigation.genesis_events` | array | Optional | Parameter for Update Investigation | | `investigation.alerts` | array | Optional | Parameter for Update Investigation | | `investigation.events` | array | Optional | Parameter for Update Investigation | | `investigation.assets` | array | Optional | Parameter for Update Investigation | | `investigation.auth_credentials` | array | Optional | Parameter for Update Investigation | | `investigation.search_queries` | array | Optional | Parameter for Update Investigation | | `investigation.contributors` | array | Optional | Parameter for Update Investigation | | `investigation.key_findings` | string | Optional | Parameter for Update Investigation | | `investigation.description` | string | Required | Parameter for Update Investigation | | `investigation.notified_at` | string | Optional | Parameter for Update Investigation | | `investigation.created_by` | string | Optional | Parameter for Update Investigation | | `investigation.status` | string | Optional | Status value | | `investigation.service_desk_id` | string | Optional | Unique identifier | | `investigation.service_desk_type` | string | Optional | Type of the resource | | `investigation.assignee_id` | string | Optional | Unique identifier | | `investigation.notes` | string | Optional | Parameter for Update Investigation | | `investigation.priority` | number | Optional | Parameter for Update Investigation | | `investigation.type` | string | Optional | Type of the resource | ### Input Example `{"investigation_id":"string","investigation":{"tags":["string"],"genesis_alerts":["string"],"genesis_events":["string"],"alerts":["string"],"events":["string"],"assets":["string"],"auth_credentials":["string"],"search_queries":["string"],"contributors":["string"],"key_findings":"string","description":"string","notified_at":"string","created_by":"string","status":"active","service_desk_id":"string","service_desk_type":"string","assignee_id":"string","notes":"string","priority":123,"type":"string"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | object | Response data | | `data.updateInvestigation` | object | Response data | | `data.updateInvestigation.alerts` | array | Response data | | `data.updateInvestigation.alerts.id` | string | Response data | | `data.updateInvestigation.assets` | array | Response data | | `data.updateInvestigation.assets.file_name` | string | Response data | | `data.updateInvestigation.assets.file` | string | Response data | | `data.updateInvestigation.created_at` | string | Response data | | `data.updateInvestigation.events` | array | Response data | | `data.updateInvestigation.events.id` | string | Response data | | `data.updateInvestigation.files_count` | object | Response data | | `data.updateInvestigation.id` | string | Response data | | `data.updateInvestigation.status` | string | Response data | | `data.updateInvestigation.tags` | array | Response data | | `data.updateInvestigation.tags.file_name` | string | Response data | | `data.updateInvestigation.tags.file` | string | Response data | | `data.updateInvestigation.tenant_id` | string | Response data | | `data.updateInvestigation.updated_at` | string | Response data | ### Output Example `{"status_code":200,"response_headers":{"Date":"Thu, 01 Dec 2022 20:51:11 GMT","Content-Type":"application/json","Content-Length":"401","Connection":"keep-alive","Access-Control-Allow-Credentials":"true","Access-Control-Allow-Headers":"Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, X-Tenant-Context, C...","Access-Control-Allow-Methods":"","Access-Control-Allow-Origin":"api.delta.taegis.secureworks.com","Access-Control-Expose-Headers":"link","Access-Control-Request-Method":"","Cache-...` # Response Headers | **Header** | **Description** | **Example** | | -------------------------------- | ------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Access-Control-Allow-Credentials | HTTP response header: Access-Control-Allow-Credentials | true | | Access-Control-Allow-Headers | HTTP response header: Access-Control-Allow-Headers | Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, X-Tenant-Context, Content-Type, Authorization, accept, Accept-Language, origin, Cache-Control, X-Requested-With, Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, X-XSS-Protection, Referrer-Policy, X-ID-Token, Access-Control-Allow-Credentials, X-Graphql-Schema, apollographql-client-name, apollographql-client-version | | Access-Control-Allow-Methods | HTTP response header: Access-Control-Allow-Methods | | | Access-Control-Allow-Origin | HTTP response header: Access-Control-Allow-Origin | api.delta.taegis.secureworks.com | | Access-Control-Expose-Headers | HTTP response header: Access-Control-Expose-Headers | link | | Access-Control-Request-Method | HTTP response header: Access-Control-Request-Method | | | Cache-Control | Directives for caching mechanisms | no-store | | Connection | HTTP response header: Connection | keep-alive | | Content-Encoding | HTTP response header: Content-Encoding | gzip | | Content-Length | The length of the response body in bytes | 650 | | Content-Type | The media type of the resource | application/json | | Date | The date and time at which the message was originated | Thu, 01 Dec 2022 18:53:34 GMT | | Pragma | HTTP response header: Pragma | no-cache | | Referrer-Policy | HTTP response header: Referrer-Policy | same-origin | | Set-Cookie | HTTP response header: Set-Cookie | access\_token=eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6IkF3MHFPM2I2d1hJQjlzOExMbFVHVyJ9.eyJodHRwczovL21pc3Npb25lL29jdG9sYWJzL2lvL2p0aSI6IjhhODA4YmZlLTk2YzYtNDc3OC05MGFlLWU3ZmYxZTg1ODMxNCIsImh0dHBzOi8vbWlzc2lvbmUvb2N0b2xhYnMvaW8vdGVuYW50SWRzIjoiMTM2ODE1IiwiaHR0cHM6Ly9taXNzaW9uZS9vY3RvbGFicy9pby90ZW5hbnRzX3YyIjoiMTM2ODE1OnRlbmFudEFuYWx5c3QiLCJodHRwczovL21pc3Npb25lL29jdG9sYWJzL2lvL3JvbGVzIjoidGVuYW50QW5hbHlzdCIsImlzcyI6Imh0dHBzOi8vdGFlZ2lzLnRhZWdpcy5hdXRoMC5jb20vIiwic3ViIjoiRkNzUXJVTmIzMmZZS1AyYU9nV0JvejI5WWhsUENzZENAY2xpZW50cyIsImF1ZCI6Imh0dHBzOi8vYXBpLmRlbHRhLnRhZWdpcy5zZWN1cmV3b3Jrcy5jb20vIiwiaWF0IjoxNjY5OTI0MzA4LCJleHAiOjE2Njk5NjAzMDgsImF6cCI6IkZDc1FyVU5iMzJmWUtQMmFPZ1dCb3oyOVlobFBDc2RDIiwic2NvcGUiOiJyZWFkOnVzZXJzIiwiZ3R5IjoiY2xpZW50LWNyZWRlbnRpYWxzIn0.BMhc58fwGNloPckkJrMCIa5-rKW5wiviqrGnITMhMZDq3w761l0btPeDjmIm7dRRVUjeuS0iwfGvYZAhaU6Jo39YP85oywHfhhIn-h3bMksfBOZuzNkvFcKa0YdO0Vs6bYUz1xKnQGeVSsYLWSLmwy4PaWv\_bhsD6Suiup\_XHwtycw537bnl-B2FjPRybyB33HPUph5zZR-MfHL6L7grcGgUXJ7\_taLRHK0IrhYCEjCkpdc\_QKqziViQEvfS1FvFgzQ1P0voxLr3zTm5a4XKTAldw7wyUi2U5xNV3jl0B3VAXQ1qOD2tu5-9pfmvsZltmz3-zh8xlzU-XRFaBRc1lw; Path=/; Expires=Thu, 01 Dec 2022 20:51:49 GMT | | Strict-Transport-Security | HTTP response header: Strict-Transport-Security | max-age=63072000; includeSubdomains; preload | | Transfer-Encoding | HTTP response header: Transfer-Encoding | chunked | | Vary | HTTP response header: Vary | Accept-Encoding | | X-Content-Type-Options | HTTP response header: X-Content-Type-Options | nosniff | | X-Request-Id | A unique identifier for the request | Root=1-63890c10-1723f03867514b83562dac05 | | X-Xss-Protection | HTTP response header: X-Xss-Protection | 1; mode=block |