Open Investigations

pk_m · September 15, 2025, 2:55pm

Hi everyone.

Looking for some genuine guidance.

Is there any possible way, through which I can show Investigations, which are in OPEN state(assigned to some SOC analysts already), in an InsightIDR dashboard card?

Thanks.

mmur_gt4e · September 18, 2025, 2:49pm

Home → Security Operations Activity → Investigation Activity Card may help

pk_m · September 18, 2025, 5:16pm

Thanks Mike!!

This partially resolves my issue, because I want some more information within the dashboard such as, assignee name, Investigation type etc.

jclawson1 · September 23, 2025, 7:49pm

I’m curious too. There’s the internal log but that’s querying events and not current state.

pk_m · September 24, 2025, 8:53am

Yes @jclawson1. There is no provision of nested queries too in LEQL.