# Investigations

> How Vigilbase OS groups findings into investigations with evidence, hypotheses, notes and an outcome.

Source: https://docs.vigilbase.com/os/concepts/investigations

An investigation is a case: one place that collects the evidence, entities, hypotheses, notes and action plans for something that needs a look. Investigations start from detection findings and can also be opened from a question, a scheduled posture review, a relevant configuration change or a coverage failure.

## Evidence first

Every factual claim in an investigation links to its evidence, such as events, entities, relationships, provider state or a verification result. Hypotheses show their confidence and the alternatives. Logs, emails, provider labels and tool output are treated as evidence, never as instructions, so text inside an event cannot tell Vigil what to do.

## Lifecycle

An investigation moves through these states:

| State | Meaning |
|---|---|
| Queued | Waiting to be picked up. |
| Investigating | Evidence is being gathered and interpreted. |
| Awaiting information | Needs input before it can continue. |
| Action proposed | A fix has been drafted as an action plan. |
| Awaiting approval | The plan is waiting for an approver. |
| Remediating | An approved plan is running. |
| Verifying | Vigilbase is checking the result of the change. |
| Resolved | Closed with an outcome. |
| Escalated | Handed to a person or team to decide. |

A resolved investigation can be reopened when new evidence arrives, without re-running an earlier execution.

## Investigations and fixes

When an investigation needs a change in a provider, it gets an action plan. The plan goes through [approval](https://docs.vigilbase.com/os/concepts/approvals-and-policy) and, after execution, [verification](https://docs.vigilbase.com/os/concepts/verification). The investigation keeps the link to the plan and its result.

See [Investigations](https://docs.vigilbase.com/os/investigations) for how to work a case in the app.