Security | Retrieve Investigations

Returns a list of security investigations, with optional filters for stage, category, or date range. The information can include associated findings, timeline entries, and remediation plans.

Required Editions

Available in: Lightning Experience

Available in: Enterprise, Performance, Unlimited, and Developer Editions with the Security Center add-on and Foundations or Agentforce 1 Editions.

User Permissions Needed
To view Security Center pages:	View Security Center
To create and edit security policies:	Manage Security Center
See Common User Access for Standard Agent Actions.

Action Details

API Name	RetrieveInvestigations
Reference Action Type	Standard Action
Does this tool run one or more prompt templates?	No
Required setup	Turn on Security Center and Security Agent with View Security Center or Manage Security Center user permission.

Guidelines and Considerations

Use RetrieveInvestigations to discover existing investigations before retrieving specific investigation details.

Supports filtering by investigation stage, category, and date range.
Includes associated findings, timeline entries, and remediation plans as optional data.
Returns a mapping of investigation IDs to names for easy lookup.
Discovers existing investigations before retrieving specific investigation details.