Skip to main content
Incident investigation correlates live commands, historical metrics, and captured security events across several hosts at once, then produces a structured report with a summary, timeline, root cause, and recommendations.
Incident investigation is a Pro feature.

​
Start an investigation

  1. From a host’s detail view, click Generate Report.
  2. Select the hosts involved and a time window (last hour, 6 hours, 24 hours, or 7 days).
  3. Click Start investigation.
The investigation opens as its own tab, alongside your terminal sessions. Ask a question, for example “why is CPU usage high?” or “check for suspicious logins.”

​
How it works

The assistant gathers evidence using:
  • Live commands on the selected hosts, run over your existing SSH sessions (or new ones opened for the investigation).
  • Historical metrics (CPU, RAM, disk) from Monitoring, for time ranges before the investigation started.
  • Security events (failed logins, bans, HTTP brute force), if security event capture was enabled on the host.
Read-only commands (listing files, checking process status, reading logs) run automatically. Anything else asks for confirmation first, the same as auto-execute in a regular terminal session, but stricter: there is no setting to bypass confirmation in an investigation.

​
The report

Click View report once the assistant has gathered enough evidence. The report includes: A finding is marked not verifiable from collected evidence if it cites a number that doesn’t appear anywhere in the commands or metrics actually gathered during the investigation. Save the report to disk or copy it as Markdown from the report dialog.

​
Multiple investigations

Each investigation is its own tab. Starting a new one doesn’t close or interrupt an investigation already in progress.