> ## Documentation Index > Fetch the complete documentation index at: https://docs-xcor.paloaltonetworks.com/llms.txt > Use this file to discover all available pages before exploring further. # Read an investigation > Understand the context, reasoning, and findings sections of an AI investigation, and verify its claims against your telemetry. > [!NOTE] > > This feature isn't available to all Palo Alto Networks Cortex XCOR users and > might not be visible in your app. For information about enabling this feature in your > environment, contact [Cortex XCOR Support](/support.md). An [investigation](/investigate/investigations) presents its work in three collapsible sections: **Context**, **Investigation activity**, and **Findings**. While the investigation runs, the first two sections fill in. When it finishes, **Findings** appears and the earlier sections collapse, because the findings summarize what they produced. > [!WARNING] > > Generative AI features can produce incorrect results, hallucinate data, and deliver > inaccurate analysis. Use generative AI features with care, and independently verify > all information produced by generative AI tools before applying it. > > Certain prompts, data, or other inputs might produce irrelevant content. Don't rely on > generative AI features or responses for any uses that exceed their designed scope. ## Investigation metadata The page header displays the investigation's name, taken from the alert it started from, and a badge with its [outcome](#investigation-outcomes). A metadata bar under the export actions displays when the investigation started, how long it ran, and who started it. Automatic investigations display **Auto-run** in place of an account. [Feedback controls](/investigate/investigations/feedback.md#rate-an-investigation) for the whole investigation sit at the opposite end of the same bar. ## Context **Context** establishes what the investigation is looking at before it looks for a cause. This includes: * A link to what started the investigation, such as an **Alert bell icon Alert**, **Panel chart icon Panel**, or **Operator**. * The investigation's starting timestamp. * Any services and labels checked in the investigation. Read this section to confirm the investigation understood the problem correctly. A context section that resolved the wrong service or the wrong time window explains findings that go on to answer the wrong question. ## Investigation activity The **Investigation activity** section lists explanations that the investigation considered, including: * **Causal chain events**: Sequential events that would produce the symptom if this explanation is correct. * **Correlated observations**: Findings that line up with the explanation but don't establish causation. * **Checkmark icon Cleared areas**: Explanations that the investigation ruled out are collected in this group and collapsed. Ruled-out explanations still matter because they describe what you don't need to examine. Each item is framed as a question and a one-line summary response. You can expand each item to view additional contextual details for that item's conclusion, including charts and queries when relevant. Tasks that found something appear first. Tasks that completed without findings are grouped into the **Checkmark icon Cleared areas** entry at the end of the list. Expand that group to confirm which possibilities the investigation eliminated. A task marked **Experimental** uses a capability that Cortex XCOR is still validating. Weigh its findings accordingly. ## Findings The **Findings** section contains the investigation's conclusion. It opens with a summary of the leading explanation in a sentence or two, including the agent's conclusion and its confidence in its findings. The section then provides: * **Charts**: The alert's query alongside the decisive evidence, so you can compare the symptom against the proposed cause on the same time axis. Markers on the chart indicate alerts and related change events. * **Recommended next steps**: Actions to confirm or act on the finding, such as a targeted query to run, or a rollback to consider when a change is the likely cause. * **Supporting evidence**: The claims behind the conclusion, in chronological order. * **Alternatives ruled out**: A summary of other potential explanations that the investigation challenged. * **Open Questions**: Details that the investigation couldn't determine on its own. These become the suggested [follow-up prompts](/investigate/investigations/start.md#follow-up-on-an-investigation). A complete investigation's findings can include a conclusion that there was no issue. In such investigations, review the recommended next steps to improve the source that triggered the investigation. ### Verify a claim Each claim under **Supporting evidence** is a one-line headline you can expand to see the telemetry behind it. This can include the chart, query, trace, or event the agent used to make it. Expand the claims that carry the most weight in the conclusion and confirm the evidence supports them. A claim you can't verify is a claim to treat as a lead rather than a fact. Each expanded claim also has [feedback controls](/investigate/investigations/feedback.md#rate-an-investigation). ## Investigation outcomes An investigation's outcome appears as a badge beside its name in the page header, and in the **Outcome** column of the [investigations list](/investigate/investigations/start.md#find-an-existing-investigation): | Outcome | Meaning | | - | - | | **Spinning loader circle In progress** | The investigation is still running. | | **Checkmark icon Successful** | The investigation discovered clear evidence and a causal chain, and its report is ready for review. | | **Information icon Partial findings** | The investigation produced initial findings. Use the report to explore the findings, and use Operator to investigate further. | | **Alert badege icon Error** | The investigation failed before producing a report. An accompanying message explains why. | A **Information icon Partial findings** outcome isn't a failure. An investigation reports what it can support rather than asserting a root cause that lacks sufficient evidence. A partial result with a clear set of open questions is often the correct outcome, and it's a good starting point for a [follow-up](/investigate/investigations/start.md#follow-up-on-an-investigation). ## Save or share an investigation Two actions at the top of a finished investigation preserve it: * **Notebook icon Save as notebook** creates a [notebook](/navigate/notebooks.md) containing the full report, named after the source alert. Use this to attach the investigation to an incident record, add your own findings, or share it with responders who weren't involved. * **Copy icon Copy investigation** copies the report to your clipboard as Markdown, for pasting into a chat thread, ticket, or postmortem. Individual sections also have **Copy icon copy** controls, so you can take only the reasoning or only the context. To share the live report instead of a copy, send its URL. A follow-up chain opens at the investigation the link points to. ## Related topics - [Investigate alerts with AI investigations](/investigate/investigations.md) - [Operator interface reference](/navigate/operator/interface.md) - [Improve investigation quality](/investigate/investigations/feedback.md) - [Start an investigation](/investigate/investigations/start.md) - [Investigate alerts automatically](/investigate/investigations/automatic-investigations.md) This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.