# ICON Send Artifacts to IDR Investigation after Custom Pattern Alert

**URL:** <https://discuss.rapid7.com/t/icon-send-artifacts-to-idr-investigation-after-custom-pattern-alert/4487>\
**Category:** Workflows\
**Created:** [April 16, 2021, 6:55pm UTC](https://discuss.rapid7.com/t/icon-send-artifacts-to-idr-investigation-after-custom-pattern-alert/4487 "2021-04-16T18:55:58Z")\
**Posts on this page:** 1\
**Showing post:** 5

<div class="post-metadata">

**Author:** ![richard\_davidsson](https://discuss.rapid7.com/user_avatar/discuss.rapid7.com/richard_davidsson/32/368_2.png) [@richard\_davidsson](https://discuss.rapid7.com/u/richard_davidsson)\
**Post date:** [September 21, 2023, 3:12pm UTC](https://discuss.rapid7.com/t/icon-send-artifacts-to-idr-investigation-after-custom-pattern-alert/4487/5 "2023-09-21T15:12:05Z")

</div>

We use the “Search Investigation” action and build a match filter like this:

[{“field”:“title”,“value”:“{{["IDR Alert"].[alert].[name]}}”,“operator”:“CONTAINS”},{“field”:“title”,“value”:“{{["IDR Alert"].[logs].[0].[name]}}”,“operator”:“CONTAINS”},{“field”:“title”,“value”:“{{["IDR Alert"].[logs].[0].[logSet].[0].[name]}}”,“operator”:“CONTAINS”},{“field”:“status”,“value”:“OPEN”,“operator”:“EQUALS”}]

---

_[View the full topic](https://discuss.rapid7.com/t/icon-send-artifacts-to-idr-investigation-after-custom-pattern-alert/4487)._