# ICON Send Artifacts to IDR Investigation after Custom Pattern Alert **URL:** \ **Category:** Workflows\ **Created:** [April 16, 2021, 6:55pm UTC](https://discuss.rapid7.com/t/icon-send-artifacts-to-idr-investigation-after-custom-pattern-alert/4487 "2021-04-16T18:55:58Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![aaron\_denton](https://discuss.rapid7.com/letter_avatar_proxy/v4/letter/a/aca169/32.png) [@aaron\_denton](https://discuss.rapid7.com/u/aaron_denton)\ **Post date:** [April 16, 2021, 6:55pm UTC](https://discuss.rapid7.com/t/icon-send-artifacts-to-idr-investigation-after-custom-pattern-alert/4487/1 "2021-04-16T18:55:58Z")
With UBAs artifacts can be inserted into workflows to add notes to the investigation. I’m not seeing that happen with workflows triggered by custom alerts. Is there a way to do that? In my example, I want to take the ticket number from our Jira ticketing system and add that to an artifact in the investigation for cross-reference. ---
**Author:** ![some\_rando](https://discuss.rapid7.com/letter_avatar_proxy/v4/letter/s/c68b51/32.png) [@some\_rando](https://discuss.rapid7.com/u/some_rando)\ **Post date:** [July 13, 2022, 3:57am UTC](https://discuss.rapid7.com/t/icon-send-artifacts-to-idr-investigation-after-custom-pattern-alert/4487/2 "2022-07-13T03:57:33Z")
@aaron_denton I submitted a feature request exactly for this today. ---
**Author:** ![pkirwan](https://discuss.rapid7.com/user_avatar/discuss.rapid7.com/pkirwan/32/2014_2.png) [@pkirwan](https://discuss.rapid7.com/u/pkirwan)\ **Post date:** [September 18, 2023, 11:05am UTC](https://discuss.rapid7.com/t/icon-send-artifacts-to-idr-investigation-after-custom-pattern-alert/4487/3 "2023-09-18T11:05:56Z")
same problem here ---
**Author:** ![richard\_davidsson](https://discuss.rapid7.com/user_avatar/discuss.rapid7.com/richard_davidsson/32/368_2.png) [@richard\_davidsson](https://discuss.rapid7.com/u/richard_davidsson)\ **Post date:** [September 21, 2023, 3:05pm UTC](https://discuss.rapid7.com/t/icon-send-artifacts-to-idr-investigation-after-custom-pattern-alert/4487/4 "2023-09-21T15:05:13Z")
If I understood it correctly this is due to the fact that the workflow is triggered by the custom detection trigger and not by the Investigation. What we did was to create a check in the workflow that collects the new investigations from IDR and matched the name of the investigation to the pattern from the custom alert trigger. That way we can get the ID of the investigation and add details to that investigation thanks to that. Unfortunately you can’t add it as an artifact at this point but we add it as a comment instead. Then we at least get information added in these ones automatically. ---
**Author:** ![richard\_davidsson](https://discuss.rapid7.com/user_avatar/discuss.rapid7.com/richard_davidsson/32/368_2.png) [@richard\_davidsson](https://discuss.rapid7.com/u/richard_davidsson)\ **Post date:** [September 21, 2023, 3:12pm UTC](https://discuss.rapid7.com/t/icon-send-artifacts-to-idr-investigation-after-custom-pattern-alert/4487/5 "2023-09-21T15:12:05Z")
We use the “Search Investigation” action and build a match filter like this: [{“field”:“title”,“value”:“{{["IDR Alert"].[alert].[name]}}”,“operator”:“CONTAINS”},{“field”:“title”,“value”:“{{["IDR Alert"].[logs].[0].[name]}}”,“operator”:“CONTAINS”},{“field”:“title”,“value”:“{{["IDR Alert"].[logs].[0].[logSet].[0].[name]}}”,“operator”:“CONTAINS”},{“field”:“status”,“value”:“OPEN”,“operator”:“EQUALS”}] ---
**Author:** ![Kelvic](https://discuss.rapid7.com/letter_avatar_proxy/v4/letter/k/c0e974/32.png) [@Kelvic](https://discuss.rapid7.com/u/Kelvic)\ **Post date:** [May 31, 2025, 11:23pm UTC](https://discuss.rapid7.com/t/icon-send-artifacts-to-idr-investigation-after-custom-pattern-alert/4487/6 "2025-05-31T23:23:39Z")
Has anyone found another way round this? Had cases where multiple comments are added to one investigation ---
**Author:** ![Darrick\_Hall](https://discuss.rapid7.com/user_avatar/discuss.rapid7.com/darrick_hall/32/2530_2.png) [@Darrick\_Hall](https://discuss.rapid7.com/u/Darrick_Hall)\ **Post date:** [June 2, 2025, 1:00pm UTC](https://discuss.rapid7.com/t/icon-send-artifacts-to-idr-investigation-after-custom-pattern-alert/4487/7 "2025-06-02T13:00:29Z")
At this time there is not an automated way to send an artifact into the investigation pane when a job is ran. When you say you’ve had cases where multiple comments are added to one investigation, can you elaborate? Why are multiple comments added? Do you have multiple workflows that are triggered when the Investigation is created?