An investigation is a case: one place that collects the evidence, entities, hypotheses, notes and action plans for something that needs a look. Investigations start from detection findings and can also be opened from a question, a scheduled posture review, a relevant configuration change or a coverage failure.
Evidence first
Every factual claim in an investigation links to its evidence, such as events, entities, relationships, provider state or a verification result. Hypotheses show their confidence and the alternatives. Logs, emails, provider labels and tool output are treated as evidence, never as instructions, so text inside an event cannot tell Vigil what to do.
Lifecycle
An investigation moves through these states:
| State | Meaning |
|---|---|
| Queued | Waiting to be picked up. |
| Investigating | Evidence is being gathered and interpreted. |
| Awaiting information | Needs input before it can continue. |
| Action proposed | A fix has been drafted as an action plan. |
| Awaiting approval | The plan is waiting for an approver. |
| Remediating | An approved plan is running. |
| Verifying | Vigilbase is checking the result of the change. |
| Resolved | Closed with an outcome. |
| Escalated | Handed to a person or team to decide. |
A resolved investigation can be reopened when new evidence arrives, without re-running an earlier execution.
Investigations and fixes
When an investigation needs a change in a provider, it gets an action plan. The plan goes through approval and, after execution, verification. The investigation keeps the link to the plan and its result.
See Investigations for how to work a case in the app.