Overview
This endpoint modifies an existing investigation case. Provide the unique investigations-id in the path to update details like the case's name, summary, status, or priority. Include only the fields you want to change in the request body; the API will return the full, updated investigation object. Use this API to programmatically manage an investigation's lifecycle. It is essential for workflows that change a case's status, update its priority, or synchronize its state with an external ticketing or case management system.
Authentication
Authentication type: Bearer Token, API Key.
You can create a token using client credentials obtained through the developer portal. The API Key (x-api-key) is provided in your onboarding email or on the API Access Management page.
Path (or URL)
PATCH https://{Trellix EDR_gateway_URL}/edr/v2/investigations/{investigations-id}
Example — {investigations-id}: f61dd2a0-37e9-11ec-982e-000000000000
Request
Request headers
Authorization: Bearer <your_bearer_token> Content-Type: application/vnd.api+json x-api-key: <your_api_key>
Authorization: This header is used to authenticate your request. You need to replace
<your_bearer_token>with the actual token you generate.Content-Type: This header tells the server that the request body format is
json:api. Even though this specific call has no request body, the API requires this header.x-api-key: This is a custom header required by the Trellix API for authentication. You'll need to replace
<your_api_key>with the key from your onboarding email or the API Access Management page.
Request body
{
"data": {
"id": "53555d40-458e-11ee-98ee-000000000000",
"type": "investigations",
"attributes": {
"caseName": "Malware",
"caseSummary": "Test Incident Name",
"caseStatus": "New",
"casePriority": "High"
}
}
}Request parameters
Parameters | Data type/Values | Description |
|---|---|---|
investigationId | string | Unique identifier for investigation case. |
Response
Response example
{
"data": {
"type": "investigations",
"id": "53555d40-458e-11ee-98ee-000000000000",
"attributes": {
"created": "2023-08-28T10:33:28.084Z",
"lastModified": "2023-08-29T09:08:26Z",
"name": "Malware",
"owner": "unknown",
"summary": "Test Incident Name",
"source": "unknown",
"isAutomatic": true,
"hint": "hostname3145",
"caseType": "Malware",
"investigated": true,
"status": "New",
"priority": "High"
}
}
}
Response codes
Status | Response | Description |
|---|---|---|
200 | OK | Your request was processed successfully. The server has returned the requested data. |
400 | Bad request | The server couldn't understand your request, likely due to a syntax error or an invalid parameter. |
401 | Access denied request | Your request was rejected because it lacks valid authentication credentials. Check your API key and token. |
403 | Forbidden | You are not authorized to access this resource. While your credentials may be valid, you don't have the necessary permissions. |
404 | Not Found | The specific resource or endpoint you requested does not exist. |
415 | Unsupported Media Type | The server rejected your request because the data format |
429 | Too Many Requests | You've exceeded the rate limit by sending too many requests in a short period. The |
500 | Internal Server Error | Something went wrong on the server's end. This is not an issue with your request. |