# Cisco XDR Investigation Data API

**Canonical:** https://apis.io/apis/cisco-xdr/cisco-xdr-investigation-data-api/  
**Provider:** Cisco XDR — https://apis.io/providers/cisco-xdr/  
**Base URL:** https://private.intel.amp.cisco.com  
**Documentation:** https://developer.cisco.com/docs/cisco-xdr/

Cisco XDR Investigation Data API is one of 89 APIs that [Cisco XDR](https://apis.io/providers/cisco-xdr/) publishes on the [APIs.io](https://apis.io/) network, described by a machine-readable OpenAPI specification. Tagged areas include Investigation Data. The published artifact set on APIs.io includes an OpenAPI specification.

The Investigation Data API from Cisco XDR — 11 operation(s) for investigation data.

## Operations (11)

| Method | Path | Summary |
|---|---|---|
| GET | `/v2/investigation/{investigation-id}/errors` | Investigation Errors |
| GET | `/v2/investigation/{investigation-id}/entities` | Investigation Entities |
| GET | `/v2/investigation/{investigation-id}/events` | Investigation Events |
| GET | `/v2/investigation/{investigation-id}/verdicts` | Investigation Verdicts |
| GET | `/v2/investigation/{investigation-id}/graph` | Investigation Relation Graph |
| GET | `/v2/investigation/{investigation-id}/indicators` | Returns a list of indicators attached to this investigation |
| GET | `/v2/investigation/{investigation-id}/observables` | Returns a list of observables attached to this investigation |
| GET | `/v2/investigation/{investigation-id}/overview` | Returns metadata about the investigation |
| GET | `/v2/investigation/{investigation-id}/status` | Investigation Status |
| GET | `/v2/investigation/{investigation-id}/summary` | Returns a Summary of the Investigation |
| GET | `/v2/investigation/{investigation-id}/targets` | Returns a list of targets attached to this investigation |

## Machine-readable artifacts (1)

- **OpenAPI** — https://raw.githubusercontent.com/api-evangelist/cisco-xdr/refs/heads/main/openapi/cisco-xdr-investigation-data-api-openapi.yml

## Other Cisco XDR APIs (12)

- [Cisco XDR Actor API](https://apis.io/apis/cisco-xdr/cisco-xdr-actor-api/)
- [Cisco XDR Asset API](https://apis.io/apis/cisco-xdr/cisco-xdr-asset-api/)
- [Cisco XDR Asset Mapping API](https://apis.io/apis/cisco-xdr/cisco-xdr-asset-mapping-api/)
- [Cisco XDR Asset Properties API](https://apis.io/apis/cisco-xdr/cisco-xdr-asset-properties-api/)
- [Cisco XDR Attack Pattern API](https://apis.io/apis/cisco-xdr/cisco-xdr-attack-pattern-api/)
- [Cisco XDR Bulk API](https://apis.io/apis/cisco-xdr/cisco-xdr-bulk-api/)
- [Cisco XDR Bundle API](https://apis.io/apis/cisco-xdr/cisco-xdr-bundle-api/)
- [Cisco XDR Campaign API](https://apis.io/apis/cisco-xdr/cisco-xdr-campaign-api/)
- [Cisco XDR Casebook API](https://apis.io/apis/cisco-xdr/cisco-xdr-casebook-api/)
- [Cisco XDR COA API](https://apis.io/apis/cisco-xdr/cisco-xdr-coa-api/)
- [Cisco XDR Deliberate API](https://apis.io/apis/cisco-xdr/cisco-xdr-deliberate-api/)
- [Cisco XDR Event API](https://apis.io/apis/cisco-xdr/cisco-xdr-event-api/)

## Tags

Investigation Data

---

Profiled by [API Evangelist](https://apievangelist.com) and published on [APIs.io](https://apis.io/apis/cisco-xdr/cisco-xdr-investigation-data-api/). The API's provider profile, Kin Score and agent-readiness rating are at https://apis.io/providers/cisco-xdr/.