Investigations
Automatic archive of offense investigations, triage runs and result readings, visible to the whole team; jump from a record straight to querying its subject.
A finished offense investigation, a saved triage, and "Explain these results" in Ask AI each leave a record here without any manual save. In every edition.
Filter and search
Tabs across the top: All / Investigations / Triage / Readings. The search box matches title and summary. Newest first; "Load more" past one page.
What a record holds
| Type | Content |
|---|---|
| Offense investigation | The full report: verdict, false-positive call, timeline, MITRE ATT&CK, affected assets, recommended action, evidence trail (each AQL run and what came back) |
| Offense triage | That run's clusters, severity, false-positive calls, recommended actions, notes |
| Result reading | The question, the AQL, and the model's reading of the result |
Every record has "Query this subject", which carries the subject (host / IP / account) into Ask AI. Investigation records also carry the offense id, which links back to that offense on the Offenses page.
Where it lives
Records are stored in copilot.db and travel with the gateway_state volume backup; everyone sees the same set. Pruned after RST_ANALYSIS_TTL_DAYS (30 by default).
Relation to Security posture
"N archived investigations and triage runs" at the bottom of Security posture is this page's count.
Ask AI
One question over events or flows. The gateway writes AQL, checks it is read-only, preflights it and runs an Ariel search; the result is a flat table, and the AQL is always there to inspect, edit or open in the Console.
Offenses
Polls QRadar offenses and summarises each; group, filter and disposition them in a live feed; notes and closes are written back to QRadar; one offense can be investigated.