> ## Documentation Index
> Fetch the complete documentation index at: https://docs.infrawatch.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Investigation workflows

> Practical workflows for infrastructure and threat analysis

Use these workflows when you have an indicator or a hypothesis and need to know
which dataset to query, what to pivot on, and how to interpret the result.

The examples use the public API. The same InfraQL expressions work in the
Infrawatch search interface.

<CardGroup cols={2}>
  <Card title="Investigate an IP" img="https://mintcdn.com/infrawatch/GgP_1dT5TbxRxYSF/images/use-cases/investigate-ip.svg?fit=max&auto=format&n=GgP_1dT5TbxRxYSF&q=85&s=51c212ecf9063527458c22dbc53c5d3b" href="/use-cases/investigate-an-ip" width="640" height="320" data-path="images/use-cases/investigate-ip.svg">
    Build host context, inspect exposed services, trace DNS, and find related
    reporting.
  </Card>

  <Card title="Pivot through passive DNS" img="https://mintcdn.com/infrawatch/YpGUqk65tCzbtHqA/images/use-cases/passive-dns.svg?fit=max&auto=format&n=YpGUqk65tCzbtHqA&q=85&s=497d4bba904ab52f295478ca91db08d8" href="/use-cases/pivot-through-passive-dns" width="640" height="320" data-path="images/use-cases/passive-dns.svg">
    Move from an address to names, or from a domain to its observed answers.
  </Card>

  <Card title="Hunt exposed services" img="https://mintcdn.com/infrawatch/YpGUqk65tCzbtHqA/images/use-cases/service-hunting.svg?fit=max&auto=format&n=YpGUqk65tCzbtHqA&q=85&s=43ba559e469e4fd8cb0dd1ca1c03d5db" href="/use-cases/hunt-exposed-services" width="640" height="320" data-path="images/use-cases/service-hunting.svg">
    Find endpoints by protocol, port, network, HTTP, TLS, fingerprint, or tag.
  </Card>

  <Card title="Enrich IP lists" img="https://mintcdn.com/infrawatch/GgP_1dT5TbxRxYSF/images/use-cases/bulk-enrichment.svg?fit=max&auto=format&n=GgP_1dT5TbxRxYSF&q=85&s=c5f1ff7537ab99dbc0d11a44a767e8b7" href="/use-cases/enrich-ip-lists" width="640" height="320" data-path="images/use-cases/bulk-enrichment.svg">
    Use bulk lookup to add bounded context to up to 100 addresses at a time.
  </Card>
</CardGroup>

<Card title="Measure a result set" icon="https://mintcdn.com/infrawatch/gCEz_Bv1hOrMPG8n/images/products/measure.svg?fit=max&auto=format&n=gCEz_Bv1hOrMPG8n&q=85&s=de995887e2324aaeba6ac28c70da274c" href="/use-cases/measure-infrastructure" horizontal width="32" height="32" data-path="images/products/measure.svg">
  Count matching records and group them by public fields without delaying the
  initial search response.
</Card>

## Choose the workflow

| Starting point       | Question                                     | Start with                                                        |
| -------------------- | -------------------------------------------- | ----------------------------------------------------------------- |
| IP address           | What is this host and what does it expose?   | [Investigate an IP](/use-cases/investigate-an-ip)                 |
| IP address or domain | Which names and addresses are related?       | [Pivot through passive DNS](/use-cases/pivot-through-passive-dns) |
| Detection hypothesis | Where is a technology or service exposed?    | [Hunt exposed services](/use-cases/hunt-exposed-services)         |
| Indicator list       | How do I enrich these addresses efficiently? | [Enrich IP lists](/use-cases/enrich-ip-lists)                     |
| Result set           | How large is it and how is it distributed?   | [Measure infrastructure](/use-cases/measure-infrastructure)       |

## Before you run an example

Create an API key with `search.view`, then export it once:

```bash theme={null}
export INFRAWATCH_API_KEY="<your-api-key>"
```

Exact counts and aggregations also require `search.aggregate`.

<CardGroup cols={2}>
  <Card title="Run your first request" icon="https://mintcdn.com/infrawatch/gCEz_Bv1hOrMPG8n/images/products/quickstart.svg?fit=max&auto=format&n=gCEz_Bv1hOrMPG8n&q=85&s=4796cb60f8da0e66c70db7544cc9aecd" href="/quickstart" width="32" height="32" data-path="images/products/quickstart.svg">
    Create a key and make a verified host search.
  </Card>

  <Card title="Understand InfraQL" icon="https://mintcdn.com/infrawatch/gCEz_Bv1hOrMPG8n/images/products/search.svg?fit=max&auto=format&n=gCEz_Bv1hOrMPG8n&q=85&s=e80dbe9b7724f88ce870e69cb367b435" href="/search" width="32" height="32" data-path="images/products/search.svg">
    Learn datasets, operators, pagination, validation, and result semantics.
  </Card>
</CardGroup>