New investigation

Ask about your recent alerts, or open one from Alerts to go deeper.

Schedules
···

Onyx No investigation loaded No data source connected. Connect one on the Integrations page to ask a question or open an alert from Alerts.

Evidence & context

Investigation context

Investigation started
Status
Ready
Evidence source
No answer yet
Selection
—
Retrieved
—
Evidence scope
—

Data sources

CrowdStrike FalconStatus unavailable
SentinelOne SingularityStatus unavailable

Session details

Session ID
—
Started
Duration
0s
AI agent
Investigator
Model for next answer
Checking configuration…
Access
Read only
Status
Ready

Each answer includes the sanitized evidence sent to its model. Follow-up questions retrieve current evidence.

SECURITY WORKSPACE