Live investigations - Infrawatch

When your question contains an observable, InfrAI runs a live investigation instead of answering from context. It fans out across datasets, reports each step as it completes, and seeds a pivot graph with what it found.

Ask so the agent investigates

A live investigation starts when a message contains both an intent and an observable.

Part	Examples
Intent	`investigate`, `triage`, `map`, `pivot`, `expand`, `check`, `look up`, `what is`, `tell me about`
Observable	An IP address, a CIDR range, or a domain name

Investigate 1.1.1.1 and map the connected infrastructure

Only globally routable addresses are investigated. Private, loopback, and reserved ranges are ignored, and a message can carry several observables.

What the agent pivots on

InfrAI chooses a pivot set from the observables it found. Each pivot is an InfraQL search you can run yourself.

IP address
Domain name
CIDR range

Pivot	Equivalent InfraQL
Passive DNS names pointing at the IP	`dns.answer_ip:"1.1.1.1"`
Observed services	`ip="1.1.1.1"`
Host inventory	`ip="1.1.1.1"`

The agent then expands the most useful related names it found and pivots again.

Pivot	Equivalent InfraQL
Passive DNS records for the name	`dns.host:"example.com"`
Records referencing the name	`dns.answer:"example.com"`
Observed services	`(domain:"example.com" OR request.host:"example.com")`

Answer addresses worth following are checked against scan data.

Pivot	Equivalent InfraQL
Observed services inside the range	`ip:"192.0.2.0/24"`
Host inventory inside the range	`ip:"192.0.2.0/24"`

Wording that points at scan data - services, ports, exposure, host inventory - keeps an IP investigation on services and hosts instead of expanding through DNS.

Watch it run

Pivots run in parallel, so steps complete out of order. The chat shows the step currently running, a completed count, and each finished step as it lands:

Working  Pivoting on related DNS naming             In progress
5 completed steps
  Investigating observable.
  Searching passive DNS for names pointing at the IP.
  Checking observed services for the IP.
  Checking host inventory for the IP.
  Pivoting on related DNS naming for dyndns64.de.

Every pivot runs under a bounded timeout. If one dataset is slow or unavailable, that pivot is reported as unavailable and the investigation continues with the evidence it has - a partial answer with visible gaps rather than a failed one.

Read the pivot graph

The investigation opens a pivot graph seeded with your observable. Nodes are typed by what they represent - hosts, services, names, related infrastructure - and each edge leads back to the observation that created it. From the graph you can:

Replay the investigation to see the order in which evidence arrived.
Continue manually and take over the pivots yourself.
Keep the investigation in a project so another analyst can continue it.

Treat the graph as evidence to verify, not a conclusion. Open the underlying observation before acting on a relationship.

Investigate an IP manually

Run the same pivots by hand and compare the evidence.

Pivot through passive DNS

Understand the DNS relationships the agent expands.

​Ask so the agent investigates

​What the agent pivots on

​Watch it run

​Read the pivot graph

Investigate an IP manually

Pivot through passive DNS

Ask so the agent investigates

What the agent pivots on

Watch it run

Read the pivot graph