Skip to main content
This feature isn’t available to all Palo Alto Networks Cortex XCOR users and might not be visible in your app. For information about enabling this feature in your environment, contact Cortex XCOR Support.
An investigation is an autonomous analysis of a systemic problem indicated by your data. Starting from an alert or a dashboard panel, an AI agent queries your metrics, events, logs, and traces, forms competing explanations, and tests each one against your data. It then produces findings with a leading hypothesis and the evidence behind it. An investigation doesn’t replace your judgment. It retrieves and correlates data first and provides you with an initial investigation, and it shows each query it ran so you can verify each claim.
Generative AI features can produce incorrect results, hallucinate data, and deliver inaccurate analysis. Use generative AI features with care, and independently verify all information produced by generative AI tools before applying it.Certain prompts, data, or other inputs might produce irrelevant content. Don’t rely on generative AI features or responses for any uses that exceed their designed scope.

​
What an investigation produces

Every investigation produces three sections, described in detail in Read an investigation:
  • Context: The established context at the start of the investigation, including when and what triggered the investigation.
  • Reasoning: Competing explanations that each include a causal chain, the observations that correlate with it, and the questions it can’t yet answer. A second tab lists the agent tasks that produced those findings.
  • Findings: A leading explanation, recommended actions, and the supporting evidence, as a set of claims you can expand to review the underlying data.

​
How an investigation runs

An orchestrating agent plans a set of tasks, dispatches them to sub-agents that run concurrently, waits for the results, and uses what it learned to plan the next round. The loop continues until the agent has enough evidence to produce findings, or until further work stops producing new findings. Each sub-agent works on one bounded question against one data source. For example, one agent searches logs for a service while another compares a metric against its recent baseline. Because they run concurrently, an investigation covers more ground than a sequential set of manual queries. An investigation typically takes a few minutes and continues once started. If you manually initiate an investigation, it continues even if you navigate away from the investigations interface. Investigations that start automatically might be completed before you open the alert.

​
Where investigations appear

The following table lists the places an investigation appears in Cortex XCOR: To start an investigation from each interface, see Start an investigation.

​
What investigations read

An investigation queries the telemetry and configuration with the same permissions as your account. It can’t access data that your account can’t access. Its findings draw on:
  • Telemetry: Metrics, change events, logs, and traces. This includes cross-telemetry correlations, such as moving from a metric label to the matching log query.
  • Alert and monitor configuration: The monitor query and condition, and the dashboards and log queries annotated on the monitor.
  • Service context: The services defined in your tenant and their related telemetry.
  • Past incidents: Resolution notes from earlier alerts on the same monitor or SLO.
Investigation quality scales with how much data is available. For habits that can improve investigations’ performance, see Improve investigation quality.

​
Investigations and Operator

Investigations and Operator are separate generative AI-powered features designed to work together.
  • Operator is a conversational assistant that can answer a question about your data in seconds, can create or modify resources, and might require your interactive input to complete a task or fully answer a query.
  • An investigation is an autonomous background analysis that produces a durable, shareable report. Unlike an Operator conversation, Cortex XCOR can also start and complete an investigation autonomously.
For a quick answer to a question, ask Operator. To generate a full correlation pass across your telemetry, start an investigation. Operator can start an investigation for you and monitor it while you continue working, and you can ask Operator follow-up questions about a completed investigation.