> ## Documentation Index
> Fetch the complete documentation index at: https://docs.guglielmine.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Send alert for investigation by Qevlar AI.

> Request the investigation of an alert by identifying observables and assessing its overall risk.



## OpenAPI

````yaml /openapi/openapi.json post /v2/investigations
openapi: 3.1.0
info:
  title: Qevlar Investigation Platform API
  description: This API analyzes observables and provides investigation capabilities.
  version: 2.0.0
servers:
  - url: https://api.qevlar.com
security: []
paths:
  /v2/investigations:
    post:
      tags:
        - v2
        - Investigation
      summary: Send alert for investigation by Qevlar AI.
      description: >-
        Request the investigation of an alert by identifying observables and
        assessing its overall risk.
      operationId: request_investigation_v2_investigations_post
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InvestigationRequest'
        required: true
      responses:
        '202':
          description: Investigation request accepted
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InvestigationSubmissionResponse'
        '401':
          description: Missing, invalid or expired authentication token
        '422':
          description: Invalid investigation request format
      security:
        - HTTPBearer: []
components:
  schemas:
    InvestigationRequest:
      properties:
        source_type:
          $ref: '#/components/schemas/AlertType'
        content:
          type: object
          title: Content
          description: >-
            The alert content, to be investigated by Qevlar AI engine, should be
            provided as a JSON object literal.This data can either be in the
            form of a JSON object literal or a string that strictly follows the
            JSON specification.
        id:
          anyOf:
            - type: string
            - type: 'null'
          title: Id
          description: >-
            The unique identifier of the alert for display on the Qevlar AI
            platform. The ID must not exceed 200 characters in length.
        metadata:
          anyOf:
            - additionalProperties:
                type: string
              type: object
            - type: 'null'
          title: Metadata
          description: >-
            Additional metadata for display on the Qevlar AI platform. This
            should be a dictionary with string or URL values, where each key is
            up to 40 characters long and each value is up to 500 characters
            long. You are responsible for ensuring that the URL is secure.
      additionalProperties: false
      type: object
      required:
        - source_type
        - content
      title: InvestigationRequest
    InvestigationSubmissionResponse:
      properties:
        alert_id:
          type: string
          format: uuid
          title: Alert Id
        status:
          $ref: '#/components/schemas/TaskStatus'
      type: object
      required:
        - alert_id
        - status
      title: InvestigationSubmissionResponse
    AlertType:
      type: string
      enum:
        - Almond
        - CortexN
        - CortexXDR
        - Email
        - Sentinel
        - Unknown
        - EDElevatorIpConnections
        - GuardDuty
        - LetsDefend
        - Sekoia
        - Splunk
      title: AlertType
    TaskStatus:
      type: string
      enum:
        - Failure
        - In progress
        - Pending
        - Success
      title: TaskStatus
  securitySchemes:
    HTTPBearer:
      type: http
      scheme: bearer

````