Configure investigation settings

The Investigations settings page configures how the Assistant runs investigations for your organization, including loops, alert continuation behavior, and IRM webhooks. Investigation usage limits are managed on the Usage page.

Before you begin

You need the Assistant Admin role to change these settings. Other users can view them.

Control loops

Loops let investigations schedule recurring follow-up checks, for example re-checking telemetry while an incident is still ongoing.

Navigate to Assistant > Settings > Investigations.
Toggle Enable loops. When off, investigations can’t create loops and existing loops pause until you turn the setting back on.

Change how alert updates continue investigations

When you enable investigation enrichment on your alerts, the Assistant starts an investigation when an alert group fires. Repeat notifications with no alert changes are ignored, and changes to the group continue the investigation that already ran, updating its report.

Navigate to Assistant > Settings > Investigations.
Configure the alert settings:
- Continue investigations on alert updates: When on, an alert change after an investigation completes is added to that investigation’s context and may continue it if the changes are significant. When off, completed investigations no longer receive alert updates, which limits inference cost. New alert groups still create investigations either way.
- Continuation window: How long after an investigation is created that alert changes still continue it instead of starting a new investigation. Set this to at least your notification policy’s repeat interval so a still-firing alert continues its original investigation. The default is 6 hours.
- Continue investigations on IRM updates: When on, a change to an IRM incident or alert group after its investigation completes resumes that investigation with the update. When off, completed investigations no longer resume on IRM updates, which limits inference cost. New incidents and alert groups still create investigations either way. This setting is independent of Continue investigations on alert updates.