Investigations
An investigation is an AI-assisted, chat-based deep dive. You ask a question in plain English; an AI agent gathers evidence from your connected tools, reasons across it, and reports back in a conversation you can steer. It's the fastest way to answer "what's going on here?" without manually pivoting between a dozen tools.
Starting an investigation
- Click Investigations in the left sidebar (
/investigations) to see your existing investigations. - Click New Investigation (or go to
/investigations/new). - You'll see "Where would you like to start?" with a few example prompts, "Investigate suspicious logins," "Analyse failed auth attempts," "Review recent alerts", and a chat box.
- Type your question (or pick an example) and send it.
CloudPeek creates the investigation and opens its workspace.
Investigations need an AI model provider. If none is configured you'll see "Set up an LLM provider to start investigating.", configure one in Settings → Model Providers.
The investigation workspace
Once open, the workspace is a conversation between you and the AI agent:
- You ask, the agent acts. As it works, it streams its steps into an Action Log, each tool query it runs and what it found.
- Results are summarised as the agent reaches conclusions.
- The header has Teaming and Report tabs for collaboration and generating a written report.
- Continue the thread by asking "Ask a follow-up question about this investigation…": the agent keeps the full context.
- Use Export Results to save the output (it becomes an artifact).
The agent is powerful but not infallible. CloudPeek shows the reminder "CloudPeek can make mistakes. Check important info." Treat AI conclusions as well-researched leads to verify, not final truth, especially before acting on them.
Staying in control (approvals)
By default, the agent must ask before making external tool calls. You control how much autonomy it has using the approval control in the chat input:
- No Approvals: every tool call runs automatically.
- Approve External Writes: read-only external calls run automatically; anything that would change an external system needs your approval.
- Approve All External: every external tool call needs approval (the default).
- Approve All: every tool call, internal or external, needs your sign-off.
When approval is required, the relevant step shows Approve / Reject buttons inline; once you decide, it shows an Approved or Rejected badge and continues. There's also a Plan mode where the agent writes out a structured plan and waits for you to Approve & run (or Edit plan / Reject plan) before doing anything. Full details in Human-in-the-Loop.
Investigation status
An investigation moves through these states as it runs:
| Status | Meaning |
|---|---|
| Pending | Created, not yet started |
| Planning | The agent is working out its approach |
| Executing | The agent is actively gathering evidence |
| Completed | The investigation finished |
| Failed | The investigation hit an error |
Tips for good investigations
- Be specific. "Investigate failed logins for
jdoebetween 09:00 and 12:00 today" beats "look at logins." - Name the tools or data you expect to be relevant if you know them.
- Iterate. Ask follow-ups to narrow down rather than trying to phrase one perfect prompt.
- Capture what you learn in the Wiki so the next investigation starts ahead.
How this connects to triage
When automatic triage analyses an incident, it produces a suggested investigation plan, a set of follow-up actions. Those are executed automatically in the background (read-only), so much of the investigation may already be done by the time you open the incident. You can always start a fresh, human-led investigation for anything that needs a closer look.
Related
- Investigations API: start and manage investigations programmatically.
- AI Responses API: the lower-level interface that powers the agent.