> ## Documentation Index
> Fetch the complete documentation index at: https://docs.infrawatch.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Live investigations

> How InfrAI turns a question into parallel pivots, streamed steps, and a pivot graph

When your question contains an observable, InfrAI runs a live investigation
instead of answering from context. It fans out across datasets, reports each
step as it completes, and seeds a pivot graph with what it found.

## Ask so the agent investigates

A live investigation starts when a message contains both an **intent** and an
**observable**.

| Part       | Examples                                                                                          |
| ---------- | ------------------------------------------------------------------------------------------------- |
| Intent     | `investigate`, `triage`, `map`, `pivot`, `expand`, `check`, `look up`, `what is`, `tell me about` |
| Observable | An IP address, a CIDR range, or a domain name                                                     |

```text theme={null}
Investigate 1.1.1.1 and map the connected infrastructure
```

<Note>
  Only globally routable addresses are investigated. Private, loopback, and
  reserved ranges are ignored, and a message can carry several observables.
</Note>

## What the agent pivots on

InfrAI chooses a pivot set from the observables it found. Each pivot is an
InfraQL search you can run yourself.

<Tabs>
  <Tab title="IP address" icon="https://mintcdn.com/infrawatch/gCEz_Bv1hOrMPG8n/images/products/hosts.svg?fit=max&auto=format&n=gCEz_Bv1hOrMPG8n&q=85&s=0ba4d5739a3862f1d01e4ddc50c9dc3f" width="32" height="32" data-path="images/products/hosts.svg">
    | Pivot                                | Equivalent InfraQL        |
    | ------------------------------------ | ------------------------- |
    | Passive DNS names pointing at the IP | `dns.answer_ip:"1.1.1.1"` |
    | Observed services                    | `ip="1.1.1.1"`            |
    | Host inventory                       | `ip="1.1.1.1"`            |

    The agent then expands the most useful related names it found and pivots
    again.
  </Tab>

  <Tab title="Domain name" icon="https://mintcdn.com/infrawatch/hFIgmGIh7O3VGQHG/images/products/dns.svg?fit=max&auto=format&n=hFIgmGIh7O3VGQHG&q=85&s=47a48af3a654f274eadb1754689f8dc4" width="32" height="32" data-path="images/products/dns.svg">
    | Pivot                            | Equivalent InfraQL                                     |
    | -------------------------------- | ------------------------------------------------------ |
    | Passive DNS records for the name | `dns.host:"example.com"`                               |
    | Records referencing the name     | `dns.answer:"example.com"`                             |
    | Observed services                | `(domain:"example.com" OR request.host:"example.com")` |

    Answer addresses worth following are checked against scan data.
  </Tab>

  <Tab title="CIDR range" icon="https://mintcdn.com/infrawatch/gCEz_Bv1hOrMPG8n/images/products/network.svg?fit=max&auto=format&n=gCEz_Bv1hOrMPG8n&q=85&s=64774b6cf0ea24fc10c96f6c5df99b8b" width="32" height="32" data-path="images/products/network.svg">
    | Pivot                              | Equivalent InfraQL  |
    | ---------------------------------- | ------------------- |
    | Observed services inside the range | `ip:"192.0.2.0/24"` |
    | Host inventory inside the range    | `ip:"192.0.2.0/24"` |
  </Tab>
</Tabs>

Wording that points at scan data - `services`, `ports`, `exposure`,
`host inventory` - keeps an IP investigation on services and hosts instead of
expanding through DNS.

## Watch it run

Pivots run in parallel, so steps complete out of order. The chat shows the step
currently running, a completed count, and each finished step as it lands:

```text theme={null}
Working  Pivoting on related DNS naming             In progress
5 completed steps
  Investigating observable.
  Searching passive DNS for names pointing at the IP.
  Checking observed services for the IP.
  Checking host inventory for the IP.
  Pivoting on related DNS naming for dyndns64.de.
```

Every pivot runs under a bounded timeout. If one dataset is slow or
unavailable, that pivot is reported as unavailable and the investigation
continues with the evidence it has - a partial answer with visible gaps rather
than a failed one.

## Read the pivot graph

The investigation opens a **pivot graph** seeded with your observable. Nodes
are typed by what they represent - hosts, services, names, related
infrastructure - and each edge leads back to the observation that created it.

From the graph you can:

* **Replay** the investigation to see the order in which evidence arrived.
* **Continue manually** and take over the pivots yourself.
* **Keep the investigation** in a project so another analyst can continue it.

<Warning>
  Treat the graph as evidence to verify, not a conclusion. Open the underlying
  observation before acting on a relationship.
</Warning>

<CardGroup cols={2}>
  <Card title="Investigate an IP manually" icon="https://mintcdn.com/infrawatch/hFIgmGIh7O3VGQHG/images/products/investigate.svg?fit=max&auto=format&n=hFIgmGIh7O3VGQHG&q=85&s=07af7d2d72ee29e21a6f8df34da95847" href="/use-cases/investigate-an-ip" width="32" height="32" data-path="images/products/investigate.svg">
    Run the same pivots by hand and compare the evidence.
  </Card>

  <Card title="Pivot through passive DNS" icon="https://mintcdn.com/infrawatch/hFIgmGIh7O3VGQHG/images/products/dns.svg?fit=max&auto=format&n=hFIgmGIh7O3VGQHG&q=85&s=47a48af3a654f274eadb1754689f8dc4" href="/use-cases/pivot-through-passive-dns" width="32" height="32" data-path="images/products/dns.svg">
    Understand the DNS relationships the agent expands.
  </Card>
</CardGroup>