1. What is Investigations for? #
A structured investigation on data.
The principle #
Investigations lets you run an evidence-based investigation on Grail data: logs, metrics and traces. Where a notebook chains queries, Investigations keeps the process: each query, each filter, each piece of evidence kept. The app was formerly called Security Investigator; it is preinstalled in all SaaS environments since version 1.330.
For whom? #
| Use | Example |
|---|---|
| Incident and root cause | Understanding a wave of 500 errors |
| Threat hunting, forensics | Tracing the actions of a suspicious IP |
| Fraud | Spotting abnormal transactions |
| Cloud | Analyzing CloudTrail, API Gateway, AWS Secrets |
2. Running an investigation #
The features, step by step.
Getting started #
- Open Investigations, then select Investigation to create a scenario.
- Set the timeframe, then write a first DQL query.
- Filter, extract useful fields, enrich results.
- Add relevant items to the evidence, then share the investigation.
fetch logs, from: now() - 2h
| filter loglevel == "ERROR"
| filter matchesPhrase(content, "connection refused")
| summarize errors = count(), by: {dt.entity.host, k8s.namespace.name}
| sort errors descAn investigation is saved automatically; you can rename it, share it and switch between investigations.
Key features #
| Feature | Role |
|---|---|
| DQL queries | Query Grail, with filters and timeframe |
| DPL Architect | Extract fields from a raw log with the DPL language |
| IP enrichment | IP reputation from third-party intelligence providers |
| Lookup tables | Tables stored in Grail to enrich results |
| Query tree | Tree of the process: go back to a previous step |
| Evidence | Keep evidence with its context |
| Collaboration | Controlled sharing, bookmarks, duplication, investigation templates |
Prerequisites #
- Logs ingested into Grail.
- The permissions listed in Hub > Investigations > Technical information.
- Basic DQL and DPL knowledge: see the Grail chapter of this course.
Notebook or Investigations? A notebook is for free exploration and documentation; Investigations is for when you must prove and hand over: major incident, security investigation, audit.
Sources #
From the official documentation consulted in November 2026. The query is an example to adapt to your fields.
