Security | Save Investigation

Creates a Security Agent investigation record, or updates an existing investigation with investigation details, category, timestamps, and risk assessment.

Required Editions

Available in: Lightning Experience

Available in: Enterprise, Performance, Unlimited, and Developer Editions with the Security Center add-on and Foundations or Agentforce 1 Editions.

User Permissions Needed
To view Security Center pages:	View Security Center
To create and edit security policies:	Manage Security Center
See Common User Access for Standard Agent Actions.

Action Details

API Name	SaveInvestigation
Reference Action Type	Standard Action
Does this tool run one or more prompt templates?	No
Required setup	Turn on Security Center and Security Agent with View Security Center or Manage Security Center user permission.

Guidelines and Considerations

SaveInvestigation establishes the foundation for associating findings, timeline entries, and impacted instances.

Executes an upsert operation by creating a new investigation when no ID exists or updating the current record when an ID is provided.
Persists investigation details discovered during analysis, saving them to permanent storage so the data is available for later use.
Tracks investigation category, risk level, and status.