What it does
The AI investigate playbook block lets the model ask questions of the store before giving a verdict: what else did this host do in the last hour, has this user logged on from this address before, where else has this hash appeared. It turns those questions into queries, runs them, and folds the results into the material the verdict is based on.
The bounds
- Read only. The agent queries; closing, assigning, isolating and notifying stay with people and playbooks.
- Guarded queries. Every query passes the same guard as an analyst's: scoped to the organization, limited in time range and rows, and limited to dictionary fields.
- A fixed budget. The number of queries per investigation is capped in Settings › AI. When the budget is spent, the verdict is produced from what was gathered.
- Transparent. Every query and its row count is listed on the alert's AI tab.
When to use it
Bind it to detections where context changes the answer: authentication anomalies, rare process ancestry, first-seen destinations. For detections whose verdict is obvious from the event itself, skip it and save the budget.