Investigations
Detecting issues is only half the job. Investigations are where raw findings become understood: tracked over time, connected to one another, grouped into cases, and explained. This is the layer that turns “here are 4,000 findings” into “here are the three things you actually need to deal with, and why.”
How it all connects
Everything in Classifyre is one connected pipeline. Investigations are the right-hand side of it:
Reading it left to right:
- Sources connect the systems you run and scan them into assets.
- Detectors read each asset and raise findings — the signals worth looking at.
- Inquiries keep watch over findings by rule, and Duplicate review connects them by shared identity — the same thing showing up more than once.
- Cases are the case files where evidence is collected and hypotheses are weighed until you reach a conclusion.
- Autopilot wraps the whole right-hand side: AI agents open inquiries, keep duplicates current, build cases, and draft hypotheses — automatically, after every scan.
If detectors answer “what did we find?”, investigations answer “what does it mean, and what should we do?”
The building blocks
The investigation layer is made of four ideas. Each has its own page.
| Building block | What it does | When you reach for it |
|---|---|---|
| Inquiry | A saved question that continuously surfaces matching findings | You want to keep watching for a class of issue |
| Duplicate review | Assets that look like the same thing, grouped by why they matched and queued for a decision | You want to find the same thing showing up in many places |
| Cases | A workspace collecting evidence, hypotheses, and a conclusion | You’re ready to investigate and resolve something |
| Autopilot | AI agents that run the above for you | You want the legwork done automatically |
A typical lifecycle
- Inquiry — Define what you want to watch and get a live count of matching findings, refreshed every scan.
- Duplicate review — Work through matched pairs grouped by why they matched, and turn what you confirm straight into a case.
- Case — Collect evidence, weigh hypotheses, and reach a conclusion. Linked inquiries keep it fed with fresh matches.
- Evidence & threads — Snapshotted assets with their findings, and hypothesis threads that link to the evidence supporting or contradicting them.
- Graph — A knowledge graph visualising entities, relationships, and evidence across the whole investigation.
Don’t want to do it by hand?
Every step above can run on Autopilot. Its AI agents keep inquiries tidy, keep duplicates current, build cases, and draft hypotheses after each scan — with a written reason for every action. You stay in control with observe-only mode and can steer it whenever you like.
Start anywhere: Inquiry · Duplicate review · Cases · Autopilot