Skip to main content
You control when investigations run. Run them for everything while you build trust, narrow them to the incidents that matter, or keep them entirely on demand. Configure this from Investigation settings in your dashboard.

​
When investigations run

​
Every incident gets an investigation automatically. A good default while you’re getting a feel for the results.
​
Define conditions that decide when an investigation runs. For example, only for incidents above a certain severity, or with a particular custom field set.
​
Start an investigation when something about an incident changes, such as severity being raised or a field being updated. See the workflows guide for the full set of triggers and conditions.
​
Investigations only run when a responder asks. You can still start one any time (see below).

​
Running an investigation on demand

In Slack, anyone can start an investigation from the incident channel:
  • Use /inc investigate in the channel.
  • Add Run an investigation as a quick action on your incident welcome message.
Outside of Slack, have investigations run automatically for the incidents that matter (see When investigations run above), or trigger one from a workflow.

​
FAQs

Yes. Use conditions to target whichever incidents you want, including by status, severity, or a custom field, so you can run investigations on triage incidents or any other subset that matters to you.
Yes, once your organization has enabled it. Anything shared in a private incident stays within that incident and is never pulled into another conversation. See What investigations can see.
Yes. Investigations work the same whether your incidents run in Slack or Microsoft Teams. The one exception is connecting other Slack channels as a source (and the change events built from them), which is Slack-only. See Connect your data.
Investigations run on incidents rather than on alerts directly. To get an investigation from an alert, turn it into an incident (for example automatically with a workflow); your triggering rules then decide whether an investigation runs.

How investigations work

What happens once an investigation starts.

Connect your data

The sources investigations draw on.