> ## Documentation Index
> Fetch the complete documentation index at: https://docs.guglielmine.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Get investigation result

> Get an investigation's incident report. alert ID was in /investigation's POST response.



## OpenAPI

````yaml /openapi/openapi.json get /v2/investigations/{alert_id}/result
openapi: 3.1.0
info:
  title: Qevlar Investigation Platform API
  description: This API analyzes observables and provides investigation capabilities.
  version: 2.0.0
servers:
  - url: https://api.qevlar.com
security: []
paths:
  /v2/investigations/{alert_id}/result:
    get:
      tags:
        - v2
        - Investigation
      summary: Get investigation result
      description: >-
        Get an investigation's incident report. alert ID was in /investigation's
        POST response.
      operationId: get_investigation_result_v2_investigations__alert_id__result_get
      parameters:
        - name: alert_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
            title: Alert Id
      responses:
        '200':
          description: Investigation result found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AlertDTO'
        '202':
          description: Investigation is still in progress
        '401':
          description: Missing, invalid or expired authentication token
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
      security:
        - HTTPBearer: []
components:
  schemas:
    AlertDTO:
      properties:
        id:
          type: string
          format: uuid
          title: Id
        profile_id:
          type: string
          format: uuid
          title: Profile Id
        external_id:
          anyOf:
            - type: string
            - type: 'null'
          title: External Id
        metadata:
          anyOf:
            - $ref: '#/components/schemas/ClientInvestigateMetadata'
            - type: 'null'
        title:
          type: string
          title: Title
        index:
          type: integer
          title: Index
        received_at:
          type: string
          format: date-time
          title: Received At
        description:
          type: string
          title: Description
        type:
          type: string
          title: Type
        insight_tags:
          items:
            $ref: '#/components/schemas/InsightTag'
          type: array
          title: Insight Tags
        investigation:
          $ref: '#/components/schemas/InvestigationDTO'
      type: object
      required:
        - id
        - profile_id
        - external_id
        - metadata
        - title
        - index
        - received_at
        - description
        - type
        - insight_tags
        - investigation
      title: AlertDTO
    HTTPValidationError:
      properties:
        detail:
          items:
            $ref: '#/components/schemas/ValidationError'
          type: array
          title: Detail
      type: object
      title: HTTPValidationError
    ClientInvestigateMetadata:
      properties:
        items:
          items:
            $ref: '#/components/schemas/ClientInvestigateMetadataItem'
          type: array
          title: Items
      type: object
      required:
        - items
      title: ClientInvestigateMetadata
    InsightTag:
      properties:
        label:
          type: string
          title: Label
        scope:
          $ref: '#/components/schemas/TagScope'
        scanner_type:
          anyOf:
            - $ref: '#/components/schemas/ScannerType'
            - type: 'null'
        description:
          type: string
          title: Description
      type: object
      required:
        - label
        - scope
        - description
      title: InsightTag
    InvestigationDTO:
      properties:
        started_at:
          type: string
          format: date-time
          title: Started At
        ended_at:
          type: string
          format: date-time
          title: Ended At
        observables:
          additionalProperties:
            $ref: '#/components/schemas/ObservableDTO'
          propertyNames:
            format: uuid
          type: object
          title: Observables
        report:
          $ref: '#/components/schemas/ReportDTO'
      type: object
      required:
        - started_at
        - ended_at
        - observables
        - report
      title: InvestigationDTO
    ValidationError:
      properties:
        loc:
          items:
            anyOf:
              - type: string
              - type: integer
          type: array
          title: Location
        msg:
          type: string
          title: Message
        type:
          type: string
          title: Error Type
      type: object
      required:
        - loc
        - msg
        - type
      title: ValidationError
    ClientInvestigateMetadataItem:
      properties:
        type:
          $ref: '#/components/schemas/ClientInvestigateMetadataType'
        name:
          type: string
          title: Name
        value:
          type: string
          title: Value
      type: object
      required:
        - type
        - name
        - value
      title: ClientInvestigateMetadataItem
    TagScope:
      type: string
      enum:
        - COUNTRY
        - DEFAULT
        - PREDICATE
      title: TagScope
    ScannerType:
      type: string
      enum:
        - AbuseIPDB
        - AlertEvidence
        - Anomalies
        - DeviceFileEvents
        - DeviceNetworkEvents
        - DeviceProcessEvents
        - EmailAttachmentInfo
        - EmailEvents
        - EmailUrlInfo
        - SecurityIncident
        - CommonSecurityLog
        - UrlClickEvents
        - UserRiskEvents
        - RegistryEvents
        - BigDataCloud
        - Cybereason AI Hunting
        - Cybereason Attack Tree
        - Cybereason Endpoint Protection
        - Cybereason Visual Search
        - IP Sub Type
        - Joe Sandbox
        - NOOP
        - Qevlar Eye
        - VirusTotal & UrlScan
        - UrlScan
        - VirusTotal
        - OPSWAT MetaDefender
        - SentinelOne File Events
        - SentinelOne Process Events
        - SentinelOne Behavior Events
        - SentinelOne Registry Events
        - xdr_data File Events
        - Zscaler
        - xdr_data Process Events
        - xdr_data Registry Events
        - xdr_data Related Alerts
        - xdr_data Network Events
      title: ScannerType
    ObservableDTO:
      properties:
        id:
          type: string
          format: uuid
          title: Id
        value:
          type: string
          title: Value
        type:
          $ref: '#/components/schemas/ObservableType'
        name:
          anyOf:
            - type: string
            - type: 'null'
          title: Name
        metadata:
          anyOf:
            - type: object
            - type: 'null'
          title: Metadata
        tags:
          items:
            oneOf:
              - $ref: '#/components/schemas/DefaultTag'
              - $ref: '#/components/schemas/PredicateTag'
              - $ref: '#/components/schemas/CountryTag'
            discriminator:
              propertyName: scope
              mapping:
                COUNTRY:
                  $ref: '#/components/schemas/CountryTag'
                DEFAULT:
                  $ref: '#/components/schemas/DefaultTag'
                PREDICATE:
                  $ref: '#/components/schemas/PredicateTag'
          type: array
          title: Tags
          default: []
        key_findings:
          items:
            $ref: '#/components/schemas/KeyFinding'
          type: array
          title: Key Findings
          default: []
        extracted_from_alert:
          type: boolean
          title: Extracted From Alert
        discovered_in:
          items:
            $ref: '#/components/schemas/ScannerType'
          type: array
          title: Discovered In
          default: []
        sources:
          items:
            $ref: '#/components/schemas/SourceUrl'
          type: array
          title: Sources
          default: []
      type: object
      required:
        - id
        - value
        - type
        - extracted_from_alert
      title: ObservableDTO
    ReportDTO:
      properties:
        id:
          type: string
          format: uuid
          title: Id
        outcome:
          $ref: '#/components/schemas/InvestigationOutcome'
        feedback:
          anyOf:
            - $ref: '#/components/schemas/FeedbackDTO'
            - type: 'null'
        overview:
          items:
            additionalProperties:
              type: string
            type: object
          type: array
          title: Overview
        indicators:
          items:
            type: string
          type: array
          title: Indicators
        investigation_next_steps:
          items:
            type: string
          type: array
          title: Investigation Next Steps
        remediation_next_steps:
          items:
            type: string
          type: array
          title: Remediation Next Steps
        steps:
          items:
            $ref: '#/components/schemas/StepDTO'
          type: array
          title: Steps
      type: object
      required:
        - id
        - outcome
        - feedback
        - overview
        - indicators
        - investigation_next_steps
        - remediation_next_steps
        - steps
      title: ReportDTO
    ClientInvestigateMetadataType:
      type: string
      enum:
        - STRING
        - URL
        - PRIVATE
      title: ClientInvestigateMetadataType
    ObservableType:
      type: string
      enum:
        - Alert
        - Command line
        - Country
        - Domain
        - Email address
        - Email header
        - Email
        - File
        - Invalid
        - IP
        - Device
        - Process
        - URL
        - User
      title: ObservableType
    DefaultTag:
      properties:
        label:
          type: string
          title: Label
        scope:
          type: string
          const: DEFAULT
          title: Scope
          default: DEFAULT
        scanner_type:
          anyOf:
            - $ref: '#/components/schemas/ScannerType'
            - type: 'null'
      type: object
      required:
        - label
      title: DefaultTag
    PredicateTag:
      properties:
        label:
          type: string
          title: Label
        scope:
          type: string
          const: PREDICATE
          title: Scope
          default: PREDICATE
        scanner_type:
          anyOf:
            - $ref: '#/components/schemas/ScannerType'
            - type: 'null'
      type: object
      required:
        - label
      title: PredicateTag
    CountryTag:
      properties:
        label:
          type: string
          title: Label
        scope:
          type: string
          const: COUNTRY
          title: Scope
          default: COUNTRY
        scanner_type:
          anyOf:
            - $ref: '#/components/schemas/ScannerType'
            - type: 'null'
      type: object
      required:
        - label
      title: CountryTag
    KeyFinding:
      properties:
        label:
          type: string
          title: Label
        value:
          type: string
          title: Value
      type: object
      required:
        - label
        - value
      title: KeyFinding
    SourceUrl:
      properties:
        scanner_type:
          $ref: '#/components/schemas/ScannerType'
        url:
          anyOf:
            - type: string
              minLength: 1
              format: uri
            - type: 'null'
          title: Url
      type: object
      required:
        - scanner_type
        - url
      title: SourceUrl
    InvestigationOutcome:
      type: string
      enum:
        - INCONCLUSIVE
        - MALICIOUS
        - NOT_HARMFUL
      title: InvestigationOutcome
    FeedbackDTO:
      properties:
        outcome:
          $ref: '#/components/schemas/InvestigationOutcome'
        description:
          anyOf:
            - type: string
            - type: 'null'
          title: Description
        created_by:
          anyOf:
            - $ref: '#/components/schemas/UserDTO'
            - $ref: '#/components/schemas/ProfileDTO'
          title: Created By
        created_at:
          type: string
          format: date-time
          title: Created At
      type: object
      required:
        - outcome
        - description
        - created_by
        - created_at
      title: FeedbackDTO
    StepDTO:
      properties:
        id:
          type: string
          format: uuid
          title: Id
        type:
          $ref: '#/components/schemas/ActionType'
        title:
          type: string
          title: Title
        input_observable_id:
          type: string
          format: uuid
          title: Input Observable Id
        extracted_observable_ids:
          items:
            type: string
            format: uuid
          type: array
          title: Extracted Observable Ids
        classification:
          $ref: '#/components/schemas/Classification'
        insights:
          items:
            type: string
          type: array
          title: Insights
        errors:
          items:
            $ref: '#/components/schemas/ScannerError'
          type: array
          title: Errors
        warnings:
          items:
            $ref: '#/components/schemas/ScannerWarning'
          type: array
          title: Warnings
        started_at:
          type: string
          format: date-time
          title: Started At
        ended_at:
          type: string
          format: date-time
          title: Ended At
        sources:
          items:
            $ref: '#/components/schemas/SourceUrl'
          type: array
          title: Sources
        key_findings:
          items:
            $ref: '#/components/schemas/KeyFinding'
          type: array
          title: Key Findings
      type: object
      required:
        - id
        - type
        - title
        - input_observable_id
        - extracted_observable_ids
        - classification
        - insights
        - errors
        - warnings
        - started_at
        - ended_at
        - sources
        - key_findings
      title: StepDTO
    UserDTO:
      properties:
        id:
          type: string
          format: uuid
          title: Id
        username:
          type: string
          title: Username
        role:
          $ref: '#/components/schemas/UserRole'
        email:
          type: string
          title: Email
      type: object
      required:
        - id
        - username
        - role
        - email
      title: UserDTO
    ProfileDTO:
      properties:
        id:
          type: string
          format: uuid
          title: Id
        username:
          type: string
          title: Username
      type: object
      required:
        - id
        - username
      title: ProfileDTO
    ActionType:
      type: string
      enum:
        - Checked reputation using CTI
        - Analyzed endpoint data
        - Browsed logs in internal sources
        - Investigated anomalies and security events
        - Browsed email logs
        - Browsed file logs
        - Browsed previous alerts logs
        - Browsed process logs
        - Browsed proxy logs
        - Examined for security threats
        - Analyzed events
      title: ActionType
    Classification:
      type: string
      enum:
        - Malicious
        - Safe
        - Suspicious
      title: Classification
    ScannerError:
      properties:
        scanner_type:
          $ref: '#/components/schemas/ScannerType'
      type: object
      required:
        - scanner_type
      title: ScannerError
    ScannerWarning:
      properties:
        scanner_type:
          $ref: '#/components/schemas/ScannerType'
        warning:
          $ref: '#/components/schemas/ScannerErrorCode'
      type: object
      required:
        - scanner_type
        - warning
      title: ScannerWarning
    UserRole:
      type: string
      enum:
        - ADMIN
        - ANALYST
      title: UserRole
    ScannerErrorCode:
      type: string
      enum:
        - InvalidArgumentError
        - NoLogFoundError
        - NotFoundError
        - ObservableScanBlocked
      title: ScannerErrorCode
  securitySchemes:
    HTTPBearer:
      type: http
      scheme: bearer

````