Actions41
- Advanced Query Actions
- Alert Actions
- Exposure Score Actions
- Indicator Actions
- Investigation Actions
- Machine Actions
- Machine Action Actions
- Recommendation Actions
- Remediation Actions
- Software Actions
- Vulnerability Actions
Investigation → Start Investigation
AI-generatedSummary
Start an investigation on a specified machine by providing the machine's ID and an optional comment.
Inputs
- Machine ID (required) — The ID of the machine to start the investigation on
- Comment (required) — An optional comment for the investigation
Output shape
a single JSON object response from the Microsoft Defender API indicating the result of starting the investigation
The response shape depends on the Microsoft Defender API's output for the start investigation endpoint. This operation performs a POST request to /api/machines/{machineId}/startInvestigation with the comment in the body.