creinv
Use the creinv operator to create a new ThreatStream investigation.
Syntax
|creinv inv_name='<string>' assignee=<number> assignee_type='{user|tsworkgroup}' [ts_users=<numbers>] [workgroups=<numbers>] [inv_description='text'] [fields=<fields>]
inv_name='<string>'
|
Specify the investigation name. |
assignee=<number>
|
Specify the assignee ID for the investigation. It can be a user id or a workgroup id. |
assignee_type='{user|tsworkgroup}'
|
Specify whether the assignee is a |
[ts_users=<numbers]
|
Optional. Specify a comma-separated list of user IDs to grant access to the investigation. |
[workgroups=numbers]
|
Optional. Specify a comma-separated list of workgroup IDs to grant access to the investigation. |
[inv_description='text']
|
Optional. Specify investigation description text. |
[fields=<fields>]
|
Optional. Specify the names of result fields sent as candidate observables. |
Usage
You can use the creinv operator to create a new ThreatStream investigation. Use the listinv operator to retrieve a list of ThreatStream investigations. Use the addinv operator to add elements to an existing ThreatStream investigation.
For information about ThreatStream investigations, refer to ThreatStream online help.
Examples
Example 1: Create a new investigation with user and workgroup access.
|creinv inv_name='test_inv' assignee=1 assignee_type='user' ts_users=1,2,3 workgroups=4,5 fields=int_col,str_col inv_Example 2: Takes a single OCSF event, selects key forensic fields across activity, endpoint, user, and process context, then creates an investigation named test_inv assigned to user ID = 1.
ocsf | limit 1 | fields activity_name, metadata.product.name, src_endpoint.hostname, src_endpoint.port, actor.user.name, actor.process.cmd_line, actor.process.file.name, actor.process.parent_process.file.name, device.os.type | creinv inv_name='test_inv' assignee=1 assignee_type='user'