Configure investigation settings

The Investigations settings page groups organization-wide behavior, alert enrichment, IRM behavior, tool approvals, and IRM webhooks. Investigation usage limits are managed on the Usage page.

Before you begin

You need the Assistant Admin role to change these settings. Other users can view them.

Control loops

Loops let investigations schedule recurring follow-up checks, for example re-checking telemetry while an incident is still ongoing.

Navigate to Assistant > Settings > Investigations.
Toggle Enable loops. When off, investigations can’t create loops and existing loops pause until you turn the setting back on.

Change how alert updates continue investigations

When you enable investigation enrichment on your alerts, the Assistant starts an investigation when an alert group fires. Repeat notifications with no alert changes are ignored, and changes to the group continue the investigation that already ran, updating its report.

Navigate to Assistant > Settings > Investigations.
In Alert enrichment, configure the alert settings:
- Continue investigations on alert updates: When on, an alert change after an investigation completes is added to that investigation’s context and may continue it if the changes are significant. When off, completed investigations no longer receive alert updates, which limits inference cost. New alert groups still create investigations either way.
- Continuation window: How long after an investigation is created that alert changes still continue it instead of starting a new investigation. Set this to at least your notification policy’s repeat interval so a still-firing alert continues its original investigation. The default is 6 hours.

Limit new alert investigations

Severity limit rules protect against a burst of alert groups starting too many investigations. Alert enrichment and IRM alert webhooks have separate limits, so one source doesn’t consume the other’s capacity.

Navigate to Assistant > Settings > Investigations.
In Alert enrichment, add, edit, or remove a rule under Alert investigation limits.
Choose All or a specific severity, the maximum number of new investigations, and a time window from 5 minutes to 24 hours.

The All rule is a shared limit for severities without their own rule. A severity-specific rule overrides All instead of counting against both limits. Without All, a severity with no rule is unlimited. By default, All limits alert enrichment to 50 new investigations per 20 minutes.

Alert enrichment limits apply only to automatically created investigations. Updates to an existing alert investigation and manual starts don’t count.

Change how IRM updates continue investigations

In IRM behavior, configure Continue investigations on IRM updates. When on, a change to an IRM incident or alert group after its investigation completes resumes that investigation with the update. When off, completed investigations no longer resume on IRM updates. New incidents and alert groups still create investigations either way. This setting is independent of Continue investigations on alert updates.

Under IRM alert investigation limits, configure how many new investigations IRM alert-group webhooks can create. The rules use the same severity, All, maximum, and window behavior as alert enrichment, with a separate default of 50 new investigations per 20 minutes. Alert-group updates and IRM incident webhooks don’t count.