> ## Documentation Index
> Fetch the complete documentation index at: https://docs.incident.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Triggering investigations

> Decide when investigations run, automatically, by condition, or on demand.

You control when investigations run. Run them for everything while you build trust, narrow them to the incidents that matter, or keep them entirely on demand.

Configure this from [Investigation settings](https://app.incident.io/~/investigations?drawer=investigation-settings) in your dashboard.

## When investigations run

<ResponseField name="Always run for all incidents">
  Every incident gets an investigation automatically. A good default while you're getting a feel for the results.
</ResponseField>

<ResponseField name="Run when conditions are met">
  Define conditions that decide when an investigation runs. For example, only for incidents above a certain severity, or
  with a particular custom field set.
</ResponseField>

<ResponseField name="Trigger via a workflow">
  Start an investigation when something about an incident changes, such as severity being raised or a field being
  updated. See the [workflows guide](/workflows/getting-started) for the full set of triggers and conditions.
</ResponseField>

<ResponseField name="Never run automatically">
  Investigations only run when a responder asks. You can still start one any time (see below).
</ResponseField>

## Running an investigation on demand

In **Slack**, anyone can start an investigation from the incident channel:

* Use `/inc investigate` in the channel.
* Add **Run an investigation** as a [quick action](/incidents/quick-actions) on your incident welcome message.

Outside of Slack, have investigations run automatically for the incidents that matter (see [When investigations run](#when-investigations-run) above), or trigger one from a [workflow](/workflows/getting-started).

## FAQs

<AccordionGroup>
  <Accordion title="Can investigations run on triage incidents, or only certain statuses?">
    Yes. Use [conditions](#when-investigations-run) to target whichever incidents you want, including by status,
    severity, or a custom field, so you can run investigations on triage incidents or any other subset that matters to
    you.
  </Accordion>

  <Accordion title="Do investigations run on private incidents?">
    Yes, once your organization has enabled it. Anything shared in a private incident stays within that incident and is
    never pulled into another conversation. See [What investigations can see](/investigations/what-we-can-see).
  </Accordion>

  <Accordion title="Do investigations work on Microsoft Teams?">
    Yes. Investigations work the same whether your incidents run in Slack or Microsoft Teams. The one exception is
    connecting *other* Slack channels as a source (and the change events built from them), which is Slack-only. See
    [Connect your data](/investigations/connect/overview).
  </Accordion>

  <Accordion title="Can I trigger an investigation from an alert?">
    Investigations run on incidents rather than on alerts directly. To get an investigation from an alert, turn it into
    an incident (for example automatically with a [workflow](/workflows/getting-started)); your triggering rules then
    decide whether an investigation runs.
  </Accordion>
</AccordionGroup>

## Related

<CardGroup cols={2}>
  <Card title="How investigations work" icon="magnifying-glass" href="/investigations/how-investigations-work">
    What happens once an investigation starts.
  </Card>

  <Card title="Connect your data" icon="server" href="/investigations/connect/overview">
    The sources investigations draw on.
  </Card>
</CardGroup>