Start an investigation

You can manually start an investigation from an alert, a dashboard panel, or Operator. Investigations can also start automatically when an alert triggers.

​

Start from an alert

The alert details page displays an investigation card:

• When an investigation already ran for the alert, the card displays its status and summary. Click Show investigation to open the full investigation.
• When no investigation exists, click Start investigation.

Investigations started from an alert are the richest, because the alert supplies the monitor query, signal labels, incident time, and any dashboards or log queries annotated on the monitor.

​

Start from a dashboard panel

Start an investigation from any dashboard panel that shows behavior you want explained, without waiting for a monitor to trigger:

1. Hold the pointer over the panel, and then click the three vertical dots icon.
2. Click Add to investigation. When an investigation already exists for that panel and time range, click Show investigation instead.

Cortex XCOR opens Operator and starts the investigation there. The panel’s query, its scope labels, and the dashboard’s time range become the investigation’s starting context. A panel investigation explains what changed in the signal you selected. Because no monitor defined what counts as a problem, it’s more likely to end with an explanation and open questions than a single root cause.

​

Start from Operator

Ask Operator to investigate an alert, a dashboard panel, or a symptom you describe. Operator confirms before starting one unless your prompt explicitly asked for it, then links to the investigation and offers to monitor it. You can also paste a dashboard panel URL into Operator. Operator resolves the dashboard, the panel, and the time window from the link. The investigation runs in the background. Progress appears as an investigation card in the conversation, and you can keep asking Operator other questions while it works.

​

Follow up on an investigation

A finished investigation often ends with open questions rather than a complete causal chain. Use follow-ups to supply context the agent couldn’t find on its own, such as a recent change it has no event for, or knowledge of your system that isn’t in your telemetry. At the bottom of an investigation, you can ask Operator questions that provide the investigation as context. When an investigation raises open questions, it also includes suggested prompts derived from them, so you can pursue a gap with one click. A prompt you’ve already sent is crossed out. Operator answers with its own tools when it can. When answering requires another full analysis pass, it starts a follow-up investigation. A follow-up investigation is a new investigation linked to the one it came from. The investigation page displays the whole chain, oldest first, with earlier findings collapsed and the newest expanded. This preserves how the analysis developed rather than overwriting it.

​

Find an existing investigation

For a list of every investigation in your tenant, go to Investigations. The list displays investigations from the last 30 days by default. The following table lists the columns in the investigations list: Filter the list with the Search field, which matches the summary, investigation ID, alert name, alert ID, and service name. Narrow further with the Outcome filter and time range control. Click any row to open that investigation. To open the alert the investigation came from, click the three vertical dots icon in the row, and then click View source alert.