Exception or rule something to resolve my problem

InsightIDR Alerts
1

So i need to make an automation for an investigation.

So when an specific asset create an investigation i want to make a comment or enrich the investigation with a message.
I need the investigation for audit
But just for that asset
Someone have an idea how can i make that?

2

Hey @acoelho ,

You can do it using the API looking for investigations of that asset and then putting comments, I attach you the link of the documentation that shows how to create the comment.

InsightIDR API Documentation (rapid7.com)

Hope this helps