Skip to main content
You control when investigations run. Run them for everything while you build trust, narrow them to the incidents that matter, or keep them entirely on demand. Configure this from Investigation settings in your dashboard.

​
When investigations run

​
Always run for all incidents
Every incident gets an investigation automatically. A good default while you’re getting a feel for the results.
​
Run when conditions are met
Define conditions that decide when an investigation runs — for example, only for incidents above a certain severity, or with a particular custom field set.
​
Trigger via a workflow
Start an investigation when something about an incident changes, such as severity being raised or a field being updated. See the workflows guide for the full set of triggers and conditions.
​
Never run automatically
Investigations only run when a responder asks. You can still start one any time (see below).

​
Running an investigation on demand

Regardless of your automatic settings, anyone can start an investigation:
  • Use /inc investigate in the incident’s Slack channel.
  • Add Run an investigation as a quick action on your incident welcome message.
  • Start one from the incident in the dashboard.

How investigations work

What happens once an investigation starts.

Connect your data

The sources investigations draw on.