> For the complete documentation index, see [llms.txt](https://docs.vectra.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.vectra.ai/operations/investigate/agentic-investigations.md).

# Agentic Investigations

**Status: Preview**

Agentic Investigations is currently in Preview. Capabilities, outputs, response speed, and availability may change before general availability.

### What is Agentic Investigations?

Agentic Investigations helps analysts understand and respond to active security incidents faster by turning incident data into a clear, plain-language investigation narrative.

Security investigations often require analysts to manually connect detections, entities, timelines, metadata, network activity, identity activity, cloud activity, and related evidence. Agentic Investigations reduces that manual effort by summarizing what happened, explaining why it matters, recommending next best actions, and guiding deeper investigation.

When enabled, analysts can use Agentic Investigations from a host or account page in the Vectra AI product experience.

Agentic Investigations uses generative AI models and Vectra AI-built agentic workflows to generate investigation summaries, explanations, and recommended next steps.

### Why use Agentic Investigations?

Agentic Investigations is designed to help security teams:

* Understand incidents faster
* Reduce manual evidence gathering
* Augment analysts with a Vectra AI investigation agent
* Identify relevant context across hosts, accounts, detections, and activity
* Prioritize the next best investigative steps
* Accelerate response while keeping analysts in control

### How do I enable it?

Agentic Investigations is available in the new Vectra AI experience, RUX, for customers on the Vectra AI Pro Platform or customers with 14 days of metadata retention.

An administrator must provide consent before the feature can be used.

### How is data handled?

#### What data is involved?

Agentic Investigations uses incident-relevant data available in the Vectra AI Platform to generate investigation summaries, explanations, and recommended next steps.

Incident-revelant data may include, detections, hosts context, account context, metadata and query content and relevant context available in the Vectra AI Platform.

Customer data is processed for the purpose of generating Agentic Investigations outputs.

#### Will third-party generative AI models be trained on my data?

Customer data is not used to train third-party generative AI models or stored beyond what is needed for operational purposes.

Logs related to Agentic Investigations are retained by Vectra AI for 30 days. Vectra AI may uses these logs to troubleshoot problems, monitor quality, support reliability, and improve the product.

#### Where is data processed?

Agentic Investigations maintains data within the appropriate geographic boundary (US, EU, AP), but requests may require processing in a different cloud region (AWS Region) than the region where customer data is primarily hosted.\
\
Vectra AI makes every effort to handle customer data within the appropriate geographic boundary. Some cross-region inference processing may occur as described below.

<table><thead><tr><th width="157.265625">Customer location</th><th>Agentic Investigations inference processing location</th></tr></thead><tbody><tr><td>United States</td><td>May be processed across supported AWS Regions within the United States</td></tr><tr><td>European Union</td><td>May be processed across supported AWS Regions within the European Union</td></tr><tr><td>Canada</td><td>May be processed across supported AWS Regions within the United States</td></tr><tr><td>Switzerland</td><td>May be processed across supported AWS Regions within the European Union</td></tr><tr><td>Australia</td><td>May be processed across supported AWS Regions within the Asia Pacific</td></tr></tbody></table>

Vectra AI implements appropriate technical and legal safeguards and complies with applicable data protection laws. Cross-region and cross-border transfers are encrypted and logged for compliance purposes.

### Usage guidance

Agentic Investigations uses custom-built Vectra AI agents that leverage advanced foundation models and agentic workflows. Because generative AI is probabilistic, summaries, explanations, and recommendations may vary.

Analysts should review the investigation output, validate the supporting context, and use their judgment before taking response actions. Agentic Investigations is intended to accelerate investigation and response while keeping analysts responsible for final decisions.

### Preview considerations

During Preview, customers should expect ongoing improvements to the quality, consistency, speed, supported investigation paths, and user experience of Agentic Investigations.

Vectra AI recommends that customers use Agentic Investigations as an investigation accelerator, validate outputs against available evidence, and provide feedback to help improve the feature before general availability.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.vectra.ai/operations/investigate/agentic-investigations.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.