Skip to main content

Investigation

Perpetual investigates cases agentically. The Investigation Agent coordinates the process by assigning questions to investigator agents, each working in its own context. Successive rounds of questions build on earlier findings. After automated investigation ends, you can add questions to steer the investigation and close the case when ready.

Automated questions advance in rounds. Questions you add run immediately without starting a new automated round.

The Investigation Agent coordinates investigations by asking successive rounds of focused questions​

The Investigation Agent delegates focused questions to investigator agents, choosing each question with the goal of improving the current case assessment. The questions draw on the case's signals and findings from previous rounds.

Each investigator agent runs in a dedicated context and is responsible for populating the findings of one case analysis block. The agents work questions in parallel, and are initialized with a snapshot of case state and the question's instructions. An investigator therefore cannot use findings that another agent produces during the same round.

When an investigator finishes, its case analysis block contains a concise finding, potential leads for a later round, and a link to the agent's chat (which preserves the work behind the finding). After each round of automated investigation, the Investigation Agent reviews the completed blocks and chooses new questions that pursue those leads or resolve remaining uncertainty.

Automated investigation has deliberate limits​

Perpetual bounds this question-and-answer loop with three rounds of automated investigation, each with a successively higher confidence threshold. Later questions must have greater expected value to the verdict before Perpetual includes them.

Perpetual checks the case investigation quota before choosing the opening questions. Once the investigation starts, Perpetual does not check the quota again between rounds. This prevents quota exhaustion from stopping a case after only part of its automated investigation.

Perpetual also limits how many cases from one detection receive automated analysis within a rolling window. One noisy detection therefore cannot consume the investigation quota by itself. Perpetual fires a webhook when a detection reaches this limit, making the event available outside Perpetual.

Background agents fill in case details when automated investigation is complete​

Perpetual follows automated investigation with several background agents that prepare the case for review:

  • Response-action agent. Adds suggested response actions.
  • Case-fields agent. Updates the case title and classification, and may suggest a closure code.
  • Summary agent. Writes the case summary after the other agents finish.

Perpetual suggests a closure code only when the case contains no response work or finding that calls for your judgment. Questions you add later do not rerun these agents.

You steer by asking questions and decide when to close the case​

The automated rounds may leave a promising lead unselected or produce a finding whose scope is too broad. You may also hold context that gives the activity a plausible benign explanation, or a finding that bears on closure may need another check. In each case, you can steer the investigation by adding the question the case still needs answered.

Perpetual assigns each additional question to a dedicated investigator agent, which executes it like any other question. The question starts immediately and produces no automated follow-up round. You can add it on the case or ask Simba to add it from a chat.

Automated investigation never closes the case. You decide when the evidence supports closure, then choose the case closure code and close the case. That code records the verdict that detection tuning uses after the investigation.