Actions41
- Advanced Query Actions
- Alert Actions
- Exposure Score Actions
- Indicator Actions
- Investigation Actions
- Machine Actions
- Machine Action Actions
- Recommendation Actions
- Remediation Actions
- Software Actions
- Vulnerability Actions
Investigation → Get All Investigations
AI-generatedSummary
Retrieve a list of all investigations from Microsoft Defender, optionally filtered and paginated using OData operators.
Inputs
- Authentication (required) — Select OAuth2 authentication method (only OAuth2 is available).
- OData Operators (optional) — Configure OData query parameters to filter, limit, and skip results. Fields available for filtering include ID, name, description, cvssV3, publishedOn, severity, and updatedOn. Parameters include Filter (string), Top (number, default 10), and Skip (number, default 0).
- Request Options (optional) — Advanced request options such as batching, proxy, timeout, and whether to ignore SSL certificate validation issues.
Output shape
a list of investigation records
The output is a list of investigations returned from the Microsoft Defender API's /api/investigations endpoint. Results can be controlled via OData operators for filtering, paging (top/skip), and are returned as an array of investigation objects.