addinv

Feedback:

addinv

Use the addinv operator to add elements to an existing ThreatStream investigation.

Syntax

|addinv investigation_id=<int> [r_id=<int> r_type=<string> | fields=<string>]

`investigation_id=<int>`	Required. Specify the ID of the investigation to which you need to add elements.
`r_id=<int>`	Required for adding a single element. Specify the ID of the element that will be added to the investigation.
`r_type=<string>`	Required for adding a single element. Specify the type of the element that will be added to the investigation. Possible options: `actor`: Actor `campaign`: Campaign `incident`: Incident `intelligence2`: Observable `signature`: Signature `tipreport`: Threat Bulletin `ttp`: TTP `vulnerability`: Vulnerability
`fields=<string>`	To add elements from in a previous table, specify a comma-separated list of columns that contain the required fields for the elements. The list must not have spaces between elements. If the previous table already has the `r_id` and `r_type` columns, then specify `fields=r_id,r_type` If the previous table has the values in the columns named differently, then specify `fields=’<column1> as r_id,<column2> as r_type’` Notes: The column used as `r_id` must be numeric. The column used as `r_type` must contain the values mentioned in the `r_type` argument.

Usage

You can use the addinv operator to add a single element to an investigation. It also supports the table mode, which uses the values from a previous table to add one element per row to an investigation.

Examples

Example 1: Add a single TTP element to an investigation.

Copy

addinv_test_table | addinv investigation_id=33 r_id=7 r_type='ttp'

Example 2: Add multiple elements from a table with matching column names.

Copy

addinv_test_table | addinv investigation_id=33 fields=r_id,r_type

Example 3: Add elements using aliased column names.

Copy

addinv_test_table | addinv investigation_id=33 fields='element_id as r_id,type as r_type'

Example 4: Add observable elements from search results to an investigation.

Copy

eventlog | where sourcetype = "okta" | addinv investigation_id=33 fields='id as r_id,type as r_type'