XDR - Investigate - Create Investigation
This atomic belongs to the Cisco XDR: Investigate atomic group.
Creates a new investigation for a list of observables in Cisco XDR. Creating an investigation will cause XDR to consult integrated products for information about each observable and compile the results. You should not attempt to fetch investigation results until the investigation completes. You can set "Wait for Completion" to true on this atomic to make sure it only returns the investigation ID once the investigation is completed.
Target: Conure APIs
Steps:
[] Build the request payload
[] Create the investigation
[] Check if the request was successful:
[]> If it was, attempt to extract the results and set the output variables
[]> If it wasn't, return an error
[] Check if we should save the investigation:
[]> If so, attempt to save the investigation
[] Check if we should wait for completion:
[]> If so, keep checking the investigation status until it's completed and then end the loop
More information about this API: https://developer.cisco.com/docs/cisco-xdr/create-investigation/