Investigations
Investigations
Open Aiden SRE -> Investigations to find investigations linked to alerts in the workspace. Use the list to reopen ongoing analysis or review a previous response.
Find a case
- Choose Open or Resolved. The navigation badge and tab counts help identify outstanding work.
- Use Search investigations to find an alert by text.
- Use All Severities to narrow the list to Critical, High, Warning, Medium, Low, or Info.
- Select the alert row to open its investigation. If a thread selector opens, choose the thread you want to review.
| Column | Meaning |
|---|---|
| Severity | Severity of the linked alert |
| Alert | The alert being investigated |
| Threads | Investigation conversations associated with that alert |
| People | Contributors who started investigation threads |
A finished analysis can still belong to an open case. Resolved reflects case or source-alert resolution; it does not mean every completed answer moves there automatically.
Start an investigation
From Alerts, select Investigate on a row or in the alert drawer. Automatic investigations can also begin when the delivery method's auto-investigate setting is enabled.
The conversation starts with alert context: title, description, severity, source, firing time, and identifiers. Read the Investigation workspace guide for the findings, evidence, threads, and events panels.
Simple and plan investigate modes use the same investigate input and retained-log skills, so RCA depth matches whether you run a direct investigate or a planned workflow.
New Conversation opens a general SRE chat. It is useful for questions without an alert, but is not the same action as starting an alert-linked investigation.
Choose how to continue
| Action | When to use it |
|---|---|
| Open an existing thread | Review the evidence or continue the same line of analysis when follow-up is available |
| New thread in the Threads panel | Restart investigation from the alert, for example after conditions change |
| Fork conversation in investigation chat | Copy the current conversation history into an independent thread to explore an alternative |
Both starting a new thread and forking create new work. Use the existing thread when you only need to read the result. If a completed investigation blocks follow-up, use the offered new-thread or fork action instead of repeatedly submitting to the completed thread.
Resolve the response
Before closing, record the mitigation or decision, recovery checks, and any remaining uncertainty. A completed investigation is not proof that a proposed action ran.
Where the investigation list opens a thread-management panel, Resolve all threads opens a confirmation showing the affected active threads. Confirm to mark those threads resolved; they remain available from Resolved. Cancel leaves them unchanged. Thread-management controls can vary with the deployed layout.
Resolving the case in SRE does not perform a mitigation or update an external incident record. See From alert to mitigation for the full response sequence.
If a case is missing
- Clear the search and severity filters and check both tabs.
- Confirm the workspace matches the alert's workspace.
- Check whether an investigation was actually started. An ingested or categorized alert does not always have one.
- Search Conversation History if you remember the conversation rather than the alert name.
- If the page displays the remote-runner banner, follow runner setup before expecting private-network inspection.