# Investigations

> Find, open and work investigations in Vigilbase OS - evidence, hypotheses, notes, plans and recording a decision.

Source: https://docs.vigilbase.com/os/investigations

**Investigations** lists your cases. A case opens when a detection fires, or when someone opens one for a question. Open it from the sidebar or press `g` then `i`. You need the `investigation.read` permission to see it.

For how cases work, see [Investigations concepts](https://docs.vigilbase.com/os/concepts/investigations).

## Find a case

By default the list shows **Open** cases (every state except resolved). Use the filters to narrow it:

- search by title, entity, technique or ID
- **State**, **Severity** and **Trigger**

Columns include **Severity**, **Case**, **Primary entity**, **State** and **Updated**. Use a row's menu to **Open case** or **Copy link**.

## Open a case for a question

:::steps
1. **Choose New investigation.** You need the `investigation.run` permission.
2. **Fill in the case.** Enter a **Title**, choose a **Severity** (Medium by default) and, optionally, a **Question** that says what the investigation should establish.
3. **Choose Open case.**
:::

## Work a case

The case page shows the severity, state and trigger, and a progress bar from **Detected** through **Investigating**, **Plan proposed**, **Awaiting approval**, **Remediating** and **Verifying** to **Resolved**. A **Next step** callout tells you what to do, for example **Review plan** when a plan is awaiting approval.

The page is organised in sections:

- **Evidence timeline** and **Evidence**: source observations grouped by type and source, with their provenance. Sensitive evidence is marked.
- **Hypotheses**: each claim lists the evidence that supports and contradicts it, a confidence level and the alternatives considered. A hypothesis is **Open**, **Supported**, **Refuted** or **Inconclusive**.
- **Action plans**, **Related entities** and **Findings** linked to the case.
- **Notes**: use **Add a note** for observations, decisions and hand-off context, then choose **Add note**.
- **Outcome**: what was decided when the case was resolved.

## Propose a fix

Choose **Propose plan** to draft an action plan for this case. You need the `action.propose` permission. See [Propose a plan](https://docs.vigilbase.com/os/approvals#propose-a-plan).

## Record a decision

:::steps
1. **Choose Record decision.** It is unavailable while a plan is running.
2. **Choose the Case state.** You can move a case to **Investigating**, **Awaiting information**, **Resolved** or **Escalated**, depending on its current state.
3. **Write an Outcome summary** when resolving: what was established, what remains uncertain and how the case was handled.
4. **Enter a Reason** and choose **Save decision.** The decision is attributed in the case timeline and the audit log.
:::

You cannot resolve a case while one of its plans is still pending. Cancel or reject the plan, or complete its recovery, first.

To reopen a resolved case, choose **Reopen case**. New evidence can also reopen a case. Reopening never repeats actions that already ran.