Investigation trail
Tool, subagent, task, attachment, and result activity remain attached to the thread so responders can audit how the conclusion was reached.
Chat investigations are the interactive workspace for changing, context-heavy incidents. They combine prompts, tool activity, approvals, attachments, shared task progress, long-running turn reliability, diagrams, and shareable thread history.

What this page covers
Start with symptoms, scope, timestamps, affected services, and what the team already checked.
Use the agent picker, thread task list, attachments, and shared thread grants to coordinate responders.
Use steering, stop controls, queued turns, and durable recovery for longer investigations.
Operational detail
Chat investigations are the interactive workspace for changing, context-heavy incidents. They combine prompts, tool activity, approvals, attachments, shared task progress, long-running turn reliability, diagrams, and shareable thread history.
Tool, subagent, task, attachment, and result activity remain attached to the thread so responders can audit how the conclusion was reached.
Share threads with users or groups using read, write, or manage permissions, with optional expiry, review, reason, and ticket metadata.
Good prompts state the alarm, time window, suspected scope, requested evidence, and whether the agent should propose or execute actions.
Related pages