create_investigation
Create a new InsightIDR investigation by specifying a title, priority, and status to initiate incident response.
Instructions
Create a new InsightIDR investigation with a title, priority, and status
Tool call template
Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.
{
"id": 1,
"jsonrpc": "2.0",
"method": "tools/call",
"params": {
"arguments": {
"title": "<title>"
},
"name": "create_investigation"
}
}Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| title | Yes | Investigation title | |
| status | No | Initial investigation status | OPEN |
| priority | No | Investigation priority | MEDIUM |
| disposition | No | Investigation disposition (typically set when closing) | |
| assignee_email | No | Email of the user to assign the investigation to |