---
title: Investigations
description: Nightshift autonomous investigations analyze Significant Events to determine root cause, assess blast radius, and propose remediation options without manual intervention.
url: https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7799/solutions/observability/nightshift/investigations
products:
  - Elastic Cloud Serverless
  - Elastic Observability
applies_to:
  - Elastic Cloud Serverless: Experimental
  - Elastic Stack: Experimental since 9.5
---

# Investigations
An investigation is a background workflow that reads memory pages, queries your streams data, and calls connected external tools to determine the root cause of a Significant Event and propose remediation options. Results include ranked root cause hypotheses with confidence scores, a conclusion with supporting evidence, and actionable next steps.
When Nightshift surfaces a `critical` or `high` severity Significant Event, it automatically triggers an investigation. For lower-severity events, you can trigger one manually using the **Run investigation** button on the event.

## How investigations work

Each investigation runs as a structured, agentic process:
- **Memory read**: Before querying raw telemetry, the investigation agent reads relevant [memory pages](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7799/solutions/observability/nightshift/memory) about your system. If Nightshift has previously encountered similar issues or has context about the affected service, it uses that knowledge as a starting point.
- **Targeted queries**: The agent runs targeted ES|QL queries against your streams to gather evidence about the event — error rates, service dependencies, infrastructure state, and related signals.
- **External tool calls**: If external connectors are configured (such as GitHub, Slack, or cloud provider APIs), the agent calls those tools to gather additional context, such as recent deployments, open incidents, or code changes.
- **Hypothesis and remediation**: The agent synthesizes all evidence into a root cause hypothesis with a confidence assessment. It also proposes ranked remediation options where it can determine them.
- **Memory write-back**: New findings — such as failure patterns or service relationships discovered during the investigation — are written back to [memory](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7799/solutions/observability/nightshift/memory) so future investigations benefit from this context.


## View investigations

You can view investigations in the Nightshift UI or chat with the AI Agent.

### From the Nightshift UI

Each Significant Event on the [landing page](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7799/solutions/observability/nightshift/nightshift) shows its investigation status. Select the event to open the details view, then expand the **Investigation** section to see results.

### From chat

Select **Open in chat** on any Significant Event to open an AI conversation with the investigation context pre-attached. You can:
- Read the full investigation narrative.
- Ask follow-up questions about specific evidence.
- Request alternative hypotheses.
- Explore remediation options in more depth.


## What an investigation produces

A completed investigation provides:
- **Hypotheses**: Ranked root cause candidates, each with a confidence percentage. The leading hypothesis reflects what the investigation determined most likely.
- **Conclusion**: The determined root cause with supporting evidence, including specific log counts, error patterns, and any source code or external signal that confirmed the finding.
- **Next steps**: Specific, actionable items. These are textual suggestions only — Nightshift does not take automated remediation actions.
- **Gaps found**: Data sources or access boundaries Nightshift couldn't reach during the investigation, such as missing structured log fields, unavailable infrastructure metrics, or connectors with limited access. Gaps are listed explicitly so you know what the investigation couldn't verify.


## Give feedback

Use the **Submit feedback** `comment` button at the top of the page to share your experience. Your feedback goes directly to the team.

## Learn more

- [Nightshift overview](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7799/solutions/observability/nightshift/nightshift): Get an overview of Nightshift, requirements, and how to get started
- [Memory](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7799/solutions/observability/nightshift/memory): Learn how Nightshift stores and uses system knowledge to improve investigation quality over time
- [How Significant Events works](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7799/solutions/observability/streams/significant-events/how-it-works): Pipeline internals for KI extraction, rule generation, detection, and discovery
- [Knowledge Indicators](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7799/solutions/observability/streams/significant-events/knowledge-indicators): Get an in-depth overview of how KIs work
- [Operator guide](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7799/solutions/observability/streams/significant-events/operator-guide): Learn more about system impact, cost drivers, and operational procedures