Inquiry

An inquiry is a saved question over your findings. It continuously tracks how many findings match its criteria and surfaces new ones as scans discover them — a live monitor that answers a single investigation question, such as “Are credentials leaking through CI logs?”

What an inquiry matches on

An inquiry narrows findings down across a few dimensions. You can use as many or as few as you like — whatever you fill in is combined, so a finding has to satisfy all of your chosen criteria to match.

Dimension	Narrows findings to…
Sources	All sources, or only the ones you pick
Detector types	Specific detectors — Secrets, PII, security, custom, and so on
Custom detectors	Specific custom detectors you’ve built
Finding types	A particular kind of signal
Finding-type pattern	Signal types matching a text pattern
Finding-value pattern	Findings whose matched content fits a text pattern

This lets an inquiry be as broad as “any PII, anywhere” or as precise as “credit-card numbers found in the finance warehouse.”

Creating an inquiry

The inquiry form is a short, three-step wizard:

Define — name the inquiry and write the question you’re trying to answer.
Criteria — choose the sources, detectors, finding types, and patterns that define a match.
Preview — see a live count of how many findings match right now, with a few sample rows, so you can fine-tune before saving.

The preview runs the same matching live, without saving — so you can experiment with the criteria until the count looks right.

The life of an inquiry

State	What it means
Active	Continuously tracking matches. A “new matches” badge appears when fresh findings match since you last looked.
Archived	Hidden from default views but kept. You can bring it back at any time.
Deleted	Permanently removed. Any cases it was driving simply lose the link.

Because inquiries keep matching as new scans land, an active inquiry is a standing watch — set it once and it keeps answering its question over time. If you ever change its criteria or want a fresh result after a quiet spell, you can re-run it to recompute matches against all current findings.

Driving cases

An inquiry can drive one or more cases. Linked to a case, it is one of the case’s watches, in the Watches panel of its board:

Select matches to pull or All copies the inquiry’s current matches into the case as evidence.
Auto-add new answers lets later scans add its new matches to the case by themselves. It is off by default, and switching it on or off is written on the case timeline.
Rules decide what the watch may bring in: filters keep a kind of finding out, and escalations mark the kinds that need attention and bring them in even with auto-add off.
Link to hypothesis hands the watch’s answers to one of the case’s hypotheses: each answer that comes in is linked as supporting, contradicting or neutral, and lands next to that hypothesis on the board.
Any new matches since the last scan are flagged, so nothing slips by while you work.

You can link a watch from either side. On the case board, the Link a watch card in the Watches panel links an existing inquiry, or creates a new one in a new tab, already set to drive the case. On the inquiry’s own page, and when you create or edit it, Cases it drives lists its cases: Link to a case adds one, and the unlink button stops it driving one (the case keeps what it already pulled). The inquiry list shows, for each inquiry, the names of the cases it drives; click one to open that case at the watch.

Editing an inquiry from a case brings you back to the case when you save or cancel.

Inquiries vs duplicate review

Inquiries and duplicate review are two complementary ways to make sense of findings:

An inquiry groups findings by rule — “show me everything matching these criteria.”
Duplicate review groups assets by shared identity — “show me everything that looks like the same entity.”

Both feed cases, and both can be maintained for you automatically by Autopilot — which keeps inquiries tidy and de-duplicated after every scan.