Security | Retrieve Investigation

Returns a complete security investigation, including findings, timeline entries, and impacted instances.

Required Editions

Available in: Lightning Experience

Available in: Enterprise, Performance, Unlimited, and Developer Editions with the Security Center add-on and Foundations or Agentforce 1 Editions.

User Permissions Needed
To view Security Center pages:	View Security Center
To create and edit security policies:	Manage Security Center
See Common User Access for Standard Agent Actions.

Action Details

API Name	RetrieveInvestigation
Reference Action Type	Standard Action
Does this tool run one or more prompt templates?	No
Required setup	Turn on Security Center and Security Agent with View Security Center or Manage Security Center user permission.

Guidelines and Considerations

Use RetrieveInvestigation to retrieve the full context of an existing security investigation.

Requires an investigation ID to retrieve the complete investigation record.
Returns all associated findings, timeline entries, and impacted instances in a single call.