:doc:`Detective <../../detective>` / Client / start_investigation

*******************
start_investigation
*******************



.. py:method:: Detective.Client.start_investigation(**kwargs)

  

  Detective investigations lets you investigate IAM users and IAM roles using indicators of compromise. An indicator of compromise (IOC) is an artifact observed in or on a network, system, or environment that can (with a high level of confidence) identify malicious activity or a security incident. ``StartInvestigation`` initiates an investigation on an entity in a behavior graph.

  

  See also: `AWS API Documentation <https://docs.aws.amazon.com/goto/WebAPI/detective-2018-10-26/StartInvestigation>`_  


  **Request Syntax**
  ::

    response = client.start_investigation(
        GraphArn='string',
        EntityArn='string',
        ScopeStartTime=datetime(2015, 1, 1),
        ScopeEndTime=datetime(2015, 1, 1)
    )
    
  :type GraphArn: string
  :param GraphArn: **[REQUIRED]** 

    The Amazon Resource Name (ARN) of the behavior graph.

    

  
  :type EntityArn: string
  :param EntityArn: **[REQUIRED]** 

    The unique Amazon Resource Name (ARN) of the IAM user and IAM role.

    

  
  :type ScopeStartTime: datetime
  :param ScopeStartTime: **[REQUIRED]** 

    The data and time when the investigation began. The value is an UTC ISO8601 formatted string. For example, ``2021-08-18T16:35:56.284Z``.

    

  
  :type ScopeEndTime: datetime
  :param ScopeEndTime: **[REQUIRED]** 

    The data and time when the investigation ended. The value is an UTC ISO8601 formatted string. For example, ``2021-08-18T16:35:56.284Z``.

    

  
  
  :rtype: dict
  :returns: 
    
    **Response Syntax**

    
    ::

      {
          'InvestigationId': 'string'
      }
      
    **Response Structure**

    

    - *(dict) --* 
      

      - **InvestigationId** *(string) --* 

        The investigation ID of the investigation report.

        
  
  **Exceptions**
  
  *   :py:class:`Detective.Client.exceptions.AccessDeniedException`

  
  *   :py:class:`Detective.Client.exceptions.InternalServerException`

  
  *   :py:class:`Detective.Client.exceptions.ValidationException`

  
  *   :py:class:`Detective.Client.exceptions.TooManyRequestsException`

  
  *   :py:class:`Detective.Client.exceptions.ResourceNotFoundException`

  