Skip to main content
You control when investigations run. Run them for everything while you build trust, narrow them to the incidents that matter, or keep them entirely on demand. Configure this from Investigation settings in your dashboard.

​
When investigations run

​
Always run for all incidents
Every incident gets an investigation automatically. A good default while you’re getting a feel for the results.
​
Run when conditions are met
Define conditions that decide when an investigation runs. For example, only for incidents above a certain severity, or with a particular custom field set.
​
Trigger via a workflow
Start an investigation when something about an incident changes, such as severity being raised or a field being updated. See the workflows guide for the full set of triggers and conditions.
​
Never run automatically
Investigations only run when a responder asks. You can still start one any time (see below).

​
Running an investigation on demand

In Slack, anyone can start an investigation from the incident channel:
  • Use /inc investigate in the channel.
  • Add Run an investigation as a quick action on your incident welcome message.
Outside of Slack, have investigations run automatically for the incidents that matter (see When investigations run above), or trigger one from a workflow.

How investigations work

What happens once an investigation starts.

Connect your data

The sources investigations draw on.