# PlatPhorm Investigate

Investigate orchestrates bounded incident analysis. Correlate owns event relationships; Evidence owns claim verification; Investigate owns planning, tool execution, ATT&CK enrichment, synthesis, and run receipts.

Canonical URL: https://investigate.platphormnews.com
Dataset source: public-safe summaries are listed from Evidence; selected sanitized events are read server-side only for an authenticated investigation.
Regression fixture: 242 sanitized events across endpoint, auth, network, cloud_storage.
Default model configuration: openai/gpt-5.6 when credentials are available; deterministic planner otherwise.
Required dependencies fail closed. No local Correlate or Evidence fallback exists.

Public machine surfaces:
- /
- /support
- /status
- /status/contracts
- /faq
- /api/health
- /api/v1/health
- /api/docs
- /openapi.json
- /openapi.yaml
- /api/v1/datasets
- /api/mcp
- /llms.txt
- /llms-full.txt
- /llms-index.json
- /llm-index.json
- /robots.txt
- /sitemap.xml
- /sitemap-main.xml
- /sitemap-index.xml
- /sitemap-full.xml
- /rss.xml
- /feed.xml
- /manifest.webmanifest
- /.well-known/mcp.json
- /.well-known/agents.json
- /.well-known/agent-policy.json
- /.well-known/ai-policy.json
- /.well-known/ai-plugin.json
- /.well-known/security.txt
- /.well-known/trust.json

MCP tools:
- correlate: Send the incident's raw SIEM events to the Correlate service and get back observations, relationships, and scored attack chains. Run this FIRST — everything else builds on its output.
- map_attack: Map the correlated observations onto MITRE ATT&CK techniques and produce an ordered kill chain by tactic. Use to explain adversary progression.
- lookup_technique: Look up one technique in the pinned official Enterprise ATT&CK 19.1 STIX subset.
- search_techniques: Search the pinned official Enterprise ATT&CK 19.1 STIX subset by ID, name, or tactic.
- build_timeline: Return the correlated observations in chronological order, optionally scoped to an entity id. Use to reconstruct the sequence of events.
- verify_claim: Send a factual claim about the incident to the Evidence service for verification, attaching correlated observations/relationships as evidence. Returns a verdict (SUPPORTED / UNSUPPORTED / …) with per-rule checks and a signed digest. Use to validate the key conclusion.
- run_investigation: Run the bounded Investigate orchestration loop and return its structured event stream.