investigation

The investigation lookup table stores metadata for security investigations created in Anomali ThreatStream. Each record represents a single investigation used to track and manage threat analysis workflows, including assignment, priority, status, and associated context. The table is read-only, cannot be modified, and is automatically updated as investigations are created or modified.

Field	Value Type	Description	Example
assignee	string	The user or workgroup currently assigned to work on the investigation. Supports both individual users and team workgroups.	john.doe@acme.com
created_ts	datetime	Timestamp when the investigation record was first created. Set automatically on creation and never changes.	Apr 10, 2026 02:19:31.849
description	string	Long-form text describing the scope of the investigation, findings, or context. Indexed for full-text search.	Structured format for threat actor profiling.
event_time	datetime	Timestamp associated with the underlying event or activity that triggered or is linked to the investigation.	Apr 10, 2026 02:19:33.000
id	int	Auto-incrementing primary key that uniquely identifies the investigation.	78370
modified_ts	datetime	Timestamp of the most recent update to the investigation record. Automatically updated on any change.	Apr 10, 2026 02:19:33.032
name	string	Title or name of the investigation. Required and unique within an organization.	Test-Investigation-0812467890
priority	string	Urgency level assigned to the investigation to guide analyst triage and response.	very low, low, medium, high, very high
reporter	string	The user who originally created or reported the investigation.	jane@acme.com
source_type	string	Indicates how the investigation was originally created.	user, rules, phishing, import, submission, resilient
submitter	string	The user who submitted the investigation, which may differ from the reporter when submissions are automated or delegated.	jane@acme.com
status	string	Current workflow state of the investigation.	unassigned, in-progress, pending, completed
tags	array	User-defined or system-generated text labels for categorizing and filtering investigations.	["origin: file:///var/lib/jenkins", "Created by Anomali"]
tlp	string	Traffic Light Protocol designation indicating the sensitivity and sharing scope of the investigation.	white, clear, green, amber, amber+strict, red