Investigation
The Investigation API provides the following methods to perform various threat investigation actions:
collectInvestigationPackage: initiates a forensic collection task on an endpoint.getInvestigationFileUrl: returns the current status and outcome of a task started viacollectInvestigationPackage,startRetrieveInvestigationFileFromEndpoint, orstartCommandExecutionOnEndpoint.killProcess: terminates a running process on a managed endpoint.startCommandExecutionOnEndpoint: executes a shell command on an endpoint and uploads the resulting output as a log file to the GravityZone centralized storage.startRetrieveInvestigationFileFromEndpoint: retrieves a file from an endpoint and uploads it to the GravityZone centralized storage location.
API URL: CONTROL_CENTER_APIs_ACCESS_URL/v1.0/jsonrpc/investigation.
Important
These methods require:
A license that includes EDR.
Advanced Investigation and Manage Networks rights.