Investigate
Investigation FAQ
Answers describe the production evidence boundary, not hypothetical capabilities.
What does it prove?
Correlate derives relationships. Evidence verifies constrained claims. Investigate plans and explains only after those factual layers complete.
Does ATT&CK prove activity?
No. MITRE ATT&CK is pinned external knowledge used to label behavior already grounded in incident observations.
What if logs are missing?
The answer names the gap and constrains the conclusion. Missing email telemetry, for example, cannot support a phishing-delivery claim.
Can a model override evidence?
No. Model output is synthesis, never raw evidence or a verified claim, and required factual dependencies fail closed.