--- title: Count Bits Security Analyst investigations description: Count completed Bits Security Analyst investigations by the values of one field. breadcrumbs: Docs > API > Count Bits Security Analyst investigations --- > For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt). # Count Bits Security Analyst investigations ## v2 (latest) {% alert level="warning" %} **Note**: This endpoint is in preview and is subject to change. To request access, contact [Datadog support](https://docs.datadoghq.com/help.md) or your Customer Success Manager. {% /alert %} | Datadog site | API endpoint | | ----------------- | ------------------------------------------------------------------------------------------------ | | app.datadoghq.com | GET https://api.datadoghq.com/api/v2/security_monitoring/security_agent/investigations/count | | us3.datadoghq.com | GET https://api.us3.datadoghq.com/api/v2/security_monitoring/security_agent/investigations/count | | us5.datadoghq.com | GET https://api.us5.datadoghq.com/api/v2/security_monitoring/security_agent/investigations/count | | app.datadoghq.eu | GET https://api.datadoghq.eu/api/v2/security_monitoring/security_agent/investigations/count | | ap1.datadoghq.com | GET https://api.ap1.datadoghq.com/api/v2/security_monitoring/security_agent/investigations/count | | ap2.datadoghq.com | GET https://api.ap2.datadoghq.com/api/v2/security_monitoring/security_agent/investigations/count | | uk1.datadoghq.com | GET https://api.uk1.datadoghq.com/api/v2/security_monitoring/security_agent/investigations/count | | app.ddog-gov.com | GET https://api.ddog-gov.com/api/v2/security_monitoring/security_agent/investigations/count | | us2.ddog-gov.com | GET https://api.us2.ddog-gov.com/api/v2/security_monitoring/security_agent/investigations/count | ### Overview Count completed Bits Security Analyst investigations by the values of one field. Buckets are sorted by ascending count. With `field=entity` or `field=signal_source`, an investigation counts in the bucket of each of its entities or sources. This endpoint requires the `security_monitoring_signals_read` permission. OAuth apps require the `security_monitoring_signals_read` authorization [scope](https://docs.datadoghq.com/api/latest/scopes.md#bits-security-analyst) to access this endpoint. ### Arguments #### Query Strings | Field | Type | Description | | ----------------------- | ------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | field [*required*] | enum | Field to count completed investigations by. Allowed enum values: `verdict`, `rule_type`, `signal_source`, `entity`. | | filter[title] | string | Only investigations whose signal title contains this text, case-insensitive. | | filter[from] | string | Only investigations last updated at or after this time, as RFC 3339 or milliseconds since the epoch. | | filter[to] | string | Only investigations last updated at or before this time, as RFC 3339 or milliseconds since the epoch. | | filter[verdict] | string | Only investigations with one of these verdicts: `benign`, `suspicious`, or `malicious`. Comma-separated values; an investigation matches any of them. | | filter[rule_id] | string | Only investigations of signals from one of these detection rule IDs. Comma-separated values; an investigation matches any of them. | | filter[rule_type] | string | Only investigations of signals from detection rules of one of these types, as returned by the count with `field=rule_type`. Comma-separated values; an investigation matches any of them. | | filter[signal_severity] | string | Only investigations of signals with one of these severities: `info`, `low`, `medium`, `high`, or `critical`. Comma-separated values; an investigation matches any of them. | | filter[signal_source] | string | Only investigations of signals from one of these sources, as returned by the count with `field=signal_source`. Comma-separated values; an investigation matches any of them. | | filter[tags] | string | Only investigations whose signal has all of these tags, written `key:value`. Comma-separated values; an investigation must have every one of them. | | filter[entity] | string | Only investigations whose signal has all of these entities. Write each entity as `attribute:value`, matching the values returned by the count endpoint with `field=entity`. Comma-separated values; an investigation must have every one of them. | ### Response {% tabs %} {% tab label="200" %} OK {% tabs %} {% tab label="Model" %} Completed investigations counted by the values of one field. | Parent field | Field | Type | Description | | ------------ | ----------------------- | -------- | ------------------------------------------------------------------------------------------------------------------------ | | | data [*required*] | object | Counts of completed investigations. | | data | attributes [*required*] | object | The counts of each value of the field. | | attributes | counts [*required*] | [object] | One bucket per value, sorted by ascending count. | | counts | count [*required*] | int64 | Number of completed investigations with this value. | | counts | value [*required*] | string | A value of the counted field. | | data | id [*required*] | string | The counted field. | | data | type [*required*] | enum | Type of the investigation counts resource. Allowed enum values: `investigation_counts`. Default: `investigation_counts`. | {% /tab %} {% tab label="Example" %} ```json { "data": { "attributes": { "counts": [ { "count": 1250, "value": "benign" } ] }, "id": "verdict", "type": "investigation_counts" } } ``` {% /tab %} {% /tabs %} {% /tab %} {% tab label="400" %} Bad Request {% tabs %} {% tab label="Model" %} API error response. | Parent field | Field | Type | Description | | ------------ | ------------------- | -------- | ------------------------------------------------------------------------------- | | | errors [*required*] | [object] | A list of errors. | | errors | detail | string | A human-readable explanation specific to this occurrence of the error. | | errors | meta | object | Non-standard meta-information about the error | | errors | source | object | References to the source of the error. | | source | header | string | A string indicating the name of a single request header which caused the error. | | source | parameter | string | A string indicating which URI query parameter caused the error. | | source | pointer | string | A JSON pointer to the value in the request document that caused the error. | | errors | status | string | Status code of the response. | | errors | title | string | Short human-readable summary of the error. | {% /tab %} {% tab label="Example" %} ```json { "errors": [ { "detail": "Missing required attribute in body", "meta": {}, "source": { "header": "Authorization", "parameter": "limit", "pointer": "/data/attributes/title" }, "status": "400", "title": "Bad Request" } ] } ``` {% /tab %} {% /tabs %} {% /tab %} {% tab label="403" %} Forbidden {% tabs %} {% tab label="Model" %} API error response. | Parent field | Field | Type | Description | | ------------ | ------------------- | -------- | ------------------------------------------------------------------------------- | | | errors [*required*] | [object] | A list of errors. | | errors | detail | string | A human-readable explanation specific to this occurrence of the error. | | errors | meta | object | Non-standard meta-information about the error | | errors | source | object | References to the source of the error. | | source | header | string | A string indicating the name of a single request header which caused the error. | | source | parameter | string | A string indicating which URI query parameter caused the error. | | source | pointer | string | A JSON pointer to the value in the request document that caused the error. | | errors | status | string | Status code of the response. | | errors | title | string | Short human-readable summary of the error. | {% /tab %} {% tab label="Example" %} ```json { "errors": [ { "detail": "Missing required attribute in body", "meta": {}, "source": { "header": "Authorization", "parameter": "limit", "pointer": "/data/attributes/title" }, "status": "400", "title": "Bad Request" } ] } ``` {% /tab %} {% /tabs %} {% /tab %} {% tab label="429" %} Too many requests {% tabs %} {% tab label="Model" %} API error response. | Field | Type | Description | | ------------------- | -------- | ----------------- | | errors [*required*] | [string] | A list of errors. | {% /tab %} {% tab label="Example" %} ```json { "errors": [ "Bad Request" ] } ``` {% /tab %} {% /tabs %} {% /tab %} {% /tabs %} ### Code Example {% tabs %} {% tab label="Curl" %} ```bash # Required query arguments export field="verdict" # Set your Datadog site and credentials export DD_SITE="datadoghq.com" # Or us3.datadoghq.com, us5.datadoghq.com, datadoghq.eu, ap1.datadoghq.com, ap2.datadoghq.com, uk1.datadoghq.com, ddog-gov.com, us2.ddog-gov.com # Use a Personal Access Token or Service Access Token export DD_BEARER_TOKEN="" curl -X GET "https://api.${DD_SITE}/api/v2/security_monitoring/security_agent/investigations/count?field=${field}" \ -H "Accept: application/json" \ -H "Authorization: Bearer ${DD_BEARER_TOKEN}" ``` {% /tab %} {% /tabs %}