Investigation

Represents the aggregated state of an investigation such as categorization, severity, and status. Can be expanded to include analyst assignment details and more.

JSON representation 
{
  "comments": [
    string
  ],
  "verdict": enum (Verdict),
  "reputation": enum (Reputation),
  "severityScore": integer,
  "status": enum (Status),
  "priority": enum (Priority),
  "rootCause": string,
  "reason": enum (Reason),
  "riskScore": integer,
  "id": string
}
Fields
comments[]

string

Comment added by the Analyst.
verdict

enum (Verdict)

Describes reason a finding investigation was resolved.
reputation

enum (Reputation)

Describes whether a finding was useful or not-useful.
severityScore

integer (uint32 format)

Severity score for a finding set by an analyst.
status

enum (Status)

Describes the workflow status of a finding.
priority

enum (Priority)

Priority of the Alert or Finding set by analyst.
rootCause

string

Root cause of the Alert or Finding set by analyst.
reason

enum (Reason)

Reason for closing the Case or Alert.
riskScore

integer (uint32 format)

Risk score for a finding set by an analyst.
id

string

Identifier for the investigation