> ## Documentation Index > Fetch the complete documentation index at: https://docs-xcor.paloaltonetworks.com/llms.txt > Use this file to discover all available pages before exploring further. # Start an investigation > Manually start an AI investigation and steer it with follow-up questions. > [!NOTE] > > This feature is in Early Access (EA), and might not be visible in your app. To learn > more about this program and the features it contains, see the > [Early access](https://docs-xcor.paloaltonetworks.com/early-access.md) page. You can manually start an [investigation](https://docs-xcor.paloaltonetworks.com/investigate/investigations) from an alert, a dashboard panel, or [Operator](https://docs-xcor.paloaltonetworks.com/navigate/operator). Investigations can also [start automatically](https://docs-xcor.paloaltonetworks.com/investigate/investigations/automatic-investigations.md) when an alert triggers. > [!WARNING] > > Generative AI features can produce incorrect results, hallucinate data, and deliver > inaccurate analysis. Use generative AI features with care, and independently verify > all information produced by generative AI tools before applying it. > > Certain prompts, data, or other inputs might produce irrelevant content. Don't rely on > generative AI features or responses for any uses that exceed their designed scope. ## Start from an alert The [alert details page](https://docs-xcor.paloaltonetworks.com/investigate/alerts/alert-details.md) displays an investigation card: * When an investigation already ran for the alert, the card displays its status and summary. Click **Show investigation** to open the full investigation. * When no investigation exists, click **Start investigation**. Investigations started from an alert are the richest, because the alert supplies the monitor query, signal labels, incident time, and any dashboards or log queries annotated on the monitor. ## Start from a dashboard panel Start an investigation from any [dashboard](https://docs-xcor.paloaltonetworks.com/observe/dashboards) panel that shows behavior you want explained, without waiting for a monitor to trigger: 1. Hold the pointer over the panel, and then click the Three vertical dots icon three vertical dots icon. 2. Click **Add to investigation**. When an investigation already exists for that panel and time range, click **Show investigation** instead. Cortex XCOR opens Operator and starts the investigation there. The panel's query, its scope labels, and the dashboard's time range become the investigation's starting context. A panel investigation explains what changed in the signal you selected. Because no monitor defined what counts as a problem, it's more likely to end with an explanation and open questions than a single root cause. ## Start from Operator Ask [Operator](https://docs-xcor.paloaltonetworks.com/navigate/operator) to investigate an alert, a dashboard panel, or a symptom you describe. Operator confirms before starting one unless your prompt explicitly asked for it, then links to the investigation and offers to monitor it. Investigate the checkout-api error rate spike that started around 14:00 UTC. Investigate the checkout-api error rate spike that started around 14:00 UTC. You can also paste a dashboard panel URL into Operator. Operator resolves the dashboard, the panel, and the time window from the link. The investigation runs in the background. Progress appears as an [investigation card](https://docs-xcor.paloaltonetworks.com/navigate/operator/interface.md#investigation-cards) in the conversation, and you can keep asking Operator other questions while it works. ## Follow up on an investigation A finished investigation often ends with open questions rather than a complete causal chain. Use follow-ups to supply context the agent couldn't find on its own, such as a recent change it has no event for, or knowledge of your system that isn't in your telemetry. At the bottom of an investigation, you can ask Operator questions that provide the investigation as context. When an investigation raises open questions, it also includes suggested prompts derived from them, so you can pursue a gap with one click. A prompt you've already sent is crossed out. Operator answers with its own tools when it can. When answering requires another full analysis pass, it starts a follow-up investigation. A follow-up investigation is a new investigation linked to the one it came from. The investigation page displays the whole chain, oldest first, with earlier findings collapsed and the newest expanded. This preserves how the analysis developed rather than overwriting it. ## Find an existing investigation For a list of every investigation in your tenant, go to **Investigations Investigations**. The list displays investigations from the last 30 days by default. The following table lists the columns in the investigations list: | Column | Description | | - | - | | **Name** | The name of the alert that started the investigation | | **Starting context** | What the investigation started from, such as an alert, panel, or Operator | | **Outcome** | The [investigation outcome](https://docs-xcor.paloaltonetworks.com/investigate/investigations/reports.md#investigation-outcomes) | | **Run by** | The account that started it, or **Auto-run** for an automatic investigation | | **Start time** | When the investigation began | | **Duration** | How long it ran | Filter the list with the **Search** field, which matches the summary, investigation ID, alert name, alert ID, and service name. Narrow further with the **Outcome** filter and time range control. Click any row to open that investigation. To open the alert the investigation came from, click the Three vertical dots icon three vertical dots icon in the row, and then click **View source alert**. ## Related topics - [Operator capabilities reference](https://docs-xcor.paloaltonetworks.com/navigate/operator/capabilities.md) - [Investigate alerts with AI investigations](https://docs-xcor.paloaltonetworks.com/investigate/investigations.md) - [Investigate alerts automatically](https://docs-xcor.paloaltonetworks.com/investigate/investigations/automatic-investigations.md) - [Respond to incidents](https://docs-xcor.paloaltonetworks.com/overview/guides/incident-response.md) - [Visualize dashboard contents with panels](https://docs-xcor.paloaltonetworks.com/observe/dashboards/panels.md) This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.