Investigations

An investigation is an AI-assisted, chat-based deep dive. You ask a question in plain English; an AI agent gathers evidence from your connected tools, reasons across it, and reports back in a conversation you can steer. It's the fastest way to answer "what's going on here?" without manually pivoting between a dozen tools.

Starting an investigation

  1. Click Investigations in the left sidebar (/investigations) to see your existing investigations.
  2. Click New Investigation (or go to /investigations/new).
  3. You'll see "Where would you like to start?" with a few example prompts, "Investigate suspicious logins," "Analyse failed auth attempts," "Review recent alerts", and a chat box.
  4. Type your question (or pick an example) and send it.

CloudPeek creates the investigation and opens its workspace.

Note

Investigations need an AI model provider. If none is configured you'll see "Set up an LLM provider to start investigating.", configure one in Settings → Model Providers.

The investigation workspace

Once open, the workspace is a conversation between you and the AI agent:

  • You ask, the agent acts. As it works, it streams its steps into an Action Log, each tool query it runs and what it found.
  • Results are summarised as the agent reaches conclusions.
  • The header has Teaming and Report tabs for collaboration and generating a written report.
  • Continue the thread by asking "Ask a follow-up question about this investigation…": the agent keeps the full context.
  • Use Export Results to save the output (it becomes an artifact).
Warning

The agent is powerful but not infallible. CloudPeek shows the reminder "CloudPeek can make mistakes. Check important info." Treat AI conclusions as well-researched leads to verify, not final truth, especially before acting on them.

Staying in control (approvals)

By default, the agent must ask before making external tool calls. You control how much autonomy it has using the approval control in the chat input:

  • No Approvals: every tool call runs automatically.
  • Approve External Writes: read-only external calls run automatically; anything that would change an external system needs your approval.
  • Approve All External: every external tool call needs approval (the default).
  • Approve All: every tool call, internal or external, needs your sign-off.

When approval is required, the relevant step shows Approve / Reject buttons inline; once you decide, it shows an Approved or Rejected badge and continues. There's also a Plan mode where the agent writes out a structured plan and waits for you to Approve & run (or Edit plan / Reject plan) before doing anything. Full details in Human-in-the-Loop.

Investigation status

An investigation moves through these states as it runs:

StatusMeaning
PendingCreated, not yet started
PlanningThe agent is working out its approach
ExecutingThe agent is actively gathering evidence
CompletedThe investigation finished
FailedThe investigation hit an error

Tips for good investigations

  • Be specific. "Investigate failed logins for jdoe between 09:00 and 12:00 today" beats "look at logins."
  • Name the tools or data you expect to be relevant if you know them.
  • Iterate. Ask follow-ups to narrow down rather than trying to phrase one perfect prompt.
  • Capture what you learn in the Wiki so the next investigation starts ahead.

How this connects to triage

When automatic triage analyses an incident, it produces a suggested investigation plan, a set of follow-up actions. Those are executed automatically in the background (read-only), so much of the investigation may already be done by the time you open the incident. You can always start a fresh, human-led investigation for anything that needs a closer look.

© 2026 CloudPeek. Agentic AI for high-consequence security operations.