Folders

Folders group investigations. A folder can hold investigations and other folders, so you can build a tree: one folder per case, per quarter, or per threat, with subfolders beneath.

Folders live on the Investigations page, next to the investigations that are not in any folder.

Create a folder

1. In the sidebar, open Investigations.
2. Click New Folder.
3. Enter a Folder Name. It is required and cannot be blank. A Description (optional) is optional.
4. Click Create Folder.

To create a subfolder, open the parent folder and click New Folder there.

A new folder belongs to the team you are acting as when you create it.

Open a folder

Click a folder to open it. The folder page shows:

• the path to the folder, from Investigations down
• counts of Subfolders, Investigations, and Total Artifacts in the folder
• its Contents: its subfolders and investigations. Use Search contents... to filter them by name, or by an investigation's description.

From a folder you can click New Investigation or New Folder to create one directly inside it.

Move items into a folder

In the card view, drag an investigation or a folder card onto a folder card. You can also drag a card onto the open folder's contents area to move it into that folder.

To move an item, you must be a member of the team that owns the item, and of the team that owns the destination folder.

Rename or duplicate a folder

• Rename: click Edit on the folder's page, or Edit in its card menu. Change the Folder Name or description and click Save Changes.
• Duplicate: click Duplicate in the folder card's menu. The copy is named after the original with " (Copy)" added, sits in the same place, and belongs to the same team. Only the folder is copied. Its investigations and subfolders are not.

Delete a folder

Click Delete in the folder card's menu, then confirm.

Who can see a folder

A folder belongs to a team. You see only the folders you can read. Creating, editing, moving, duplicating or deleting a folder needs write access for its team.

A folder's access is separate from the access of what is inside it. Each investigation keeps its own team and its own access. See Who can see an investigation.

Over the API

GET /folders, POST /folders, GET, PUT and DELETE /folders/{id}, and POST /folders/{id}/copies to duplicate.

A folder's parent is its parent_id. An investigation's folder is its folder_id, set with PUT /investigations/{id}. To list the investigations in one folder, call GET /investigations with folderId.