inv_status="<status>"

Filter results by status. Specify all, completed, pending, in-progress, unassigned. If this option is not specified, all investigations are returned.

Usage

You can use the listinv operator to retrieve a list of ThreatStream investigations.

For information about ThreatStream investigations, refer to ThreatStream online help.

Examples

Example 1: Returns all investigations using the default status filter.

Example 2: Returns all investigations regardless of status.

Example 3: Returns only investigations in a pending state.

Example 4: Retrieves all investigations regardless of status, then counts them grouped by status to give a quick breakdown of open, closed, and other investigation statuses.