> ## Documentation Index
> Fetch the complete documentation index at: https://docs.traversal.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Investigations

> Start an investigation, ask about an incident, or explore your system using natural language.

The Investigations page is where you interact with Traversal's AI SRE. You can spin up an investigation, ask about an active incident, or explore system behavior — all in natural language.

## Starting an investigation

Type your question or paste an incident description directly into the input. Traversal parses the text for entities (teams, services) and extracts the date and time if present.

<Tip>
  Type `@` to reference teams, services, applications, environments, or other scoped entities and add context quickly.
</Tip>

### Pasting incident descriptions

You can paste a snippet from a ticket, Slack thread, or alert directly. Traversal will extract the relevant entities and time window automatically.

**Time formats that parse well:**

* `Oct 23 20:00 UTC`
* `10/23/2024 at 20:00 UTC`
* `Oct 23 4pm ET 2024`
* `5pm EST yesterday`

<Warning>
  When running in deep mode, Traversal requires a start date and time with a timezone. If you omit the time window, deep mode will not run.
</Warning>

### Writing effective descriptions

Better descriptions produce better results. Include:

* When the issue started
* Error messages you're seeing
* Affected teams or services
* Links to relevant alerts or runbooks

## What Traversal returns

Each investigation returns a root cause analysis (RCA) with the following:

<CardGroup cols={2}>
  <Card title="Root cause summary" icon="magnifying-glass">
    A summary statement with a confidence level and supporting evidence.
  </Card>

  <Card title="Evidence citations" icon="link">
    Clickable citations including metrics anomalies, log lines, deployments, code diffs, and topology relationships.
  </Card>

  <Card title="Timeline" icon="clock">
    A sequence showing when symptoms began, anomalies were detected, deployments occurred, and dependent services started failing.
  </Card>

  <Card title="Recommended next steps" icon="list-check">
    Diagnostic suggestions, remediation steps, runbook-style guidance, and suggested team escalations.
  </Card>
</CardGroup>

### Confidence levels

| Level      | Meaning                                                                       |
| ---------- | ----------------------------------------------------------------------------- |
| **High**   | Strong correlation patterns with consistent evidence across multiple signals. |
| **Medium** | Theory is plausible and likely, but missing full visibility or traces.        |
| **Low**    | Weak or partial signals. Requires human confirmation.                         |

<Note>
  Traversal's recommended next steps are suggestions, not actions. Traversal will not make changes to your system without your permission.
</Note>

## Asking follow-up questions

You can continue an investigation by asking follow-up questions in the web app or in the Slack thread for that investigation. Examples:

* Drill into a specific symptom
* Slice the timeline to a narrower window
* Request more detail on a particular signal

<Tip>
  In Slack, reply with `@Traversal` and additional context, for example: `@Traversal focus on payments-api in prod-us-east after 12:05 UTC`.
</Tip>

<Note>
  To change the analysis time window, start a new investigation with the revised time range rather than asking as a follow-up.
</Note>