`client.investigations`¶

Inspect and start investigations.

Property¶

client.investigations

Methods¶

get_all(query: InvestigationQuery | None = None) -> InvestigationResults: list investigations.
get(id: str) -> InvestigationResults: fetch one investigation by ID.
startInvestigation(deviceId: str, payload: StartInvestigationPayload) -> InvestigationResults: start an investigation for a device.
initiateInvestigation(machine_id: str, payload: InitiateInvestigationPayload) -> InvestigationResults: initiate an investigation for a machine.

Notes¶

startInvestigation() is exposed from the investigations property but delegates to a machine-scoped action under the hood.
initiateInvestigation() targets an undocumented machine-scoped investigation path.
Read methods use the standard lazy wrapper behavior.

API¶

InvestigationQuery ¶

Query parameters for the /api/investigations endpoint.

All fields are optional — omitted fields are simply not sent. Pydantic enforces the constraints (ge/le) at construction time, so invalid values are caught before hitting the wire.

Example:

query = InvestigationQuery(status="Active", pageSize=500)
query = InvestigationQuery(severity=["Medium", "High"], pageSize=500)

InvestigationResults ¶

InvestigationResults(
    endpoint: BaseEndpoint,
    params: dict[str, str],
    *,
    path: str | None = None,
    single: bool = False,
    files: bool = False,
    method: str = "GET",
    request_kwargs: dict[str, Any] | None = None,
    use_concurrent_skip_pagination: bool | None = None,
    skip_page_size: int | None = None,
    skip_max_concurrent: int | None = None,
)

Results from the /api/investigations endpoint.

InvestigationsEndpoint ¶

InvestigationsEndpoint(http: Client, auth: MSALAuth)

Endpoint for /api/investigations

get_all ¶

get_all(
    query: InvestigationQuery | None = None,
) -> InvestigationResults

Get investigations with optional filters.

Docs: - https://learn.microsoft.com/en-us/defender-endpoint/api/get-investigations

get ¶

get(id: str) -> InvestigationResults

Get a specific investigation by ID.

Docs: - https://learn.microsoft.com/en-us/defender-endpoint/api/get-investigation-by-id

startInvestigation ¶

startInvestigation(
    deviceId: str, payload: StartInvestigationPayload
) -> InvestigationResults

Start an investigation.

Docs: https://learn.microsoft.com/en-us/defender-endpoint/api/initiate-autoir-investigation

initiateInvestigation ¶

initiateInvestigation(
    machine_id: str, payload: InitiateInvestigationPayload
) -> InvestigationResults