> ## Documentation Index
> Fetch the complete documentation index at: https://docs.myrmex.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Investigation Wizard

> Turn an alert — or a whole cluster of them — into a structured SOC investigation, with indicators extracted and context attached automatically.

import { CardGroup, Card, Note, Steps, Step, Tip } from '@mintlify/components';

The **Investigation Wizard** is the bridge between triage and response. Starting from one alert or several, it does the tedious set-up for you — pulling out indicators, gathering context, and writing the prompt — then hands a ready-to-run investigation to Centurion's SOC variant.

## Where It Starts

You launch the wizard from the [Alerts](/documentation/detection-response/alerts) tab:

<CardGroup cols={2}>
  <Card title="From one alert" icon="magnifying-glass">
    Use **Investigate / Enrich** on a single detection to investigate it on its
    own.
  </Card>

  <Card title="From many alerts" icon="layer-group">
    Multi-select a cluster and use **bulk investigate** to open one investigation
    across all of them.
  </Card>
</CardGroup>

## What the Wizard Prepares

Before anything reaches the AI, the wizard assembles the investigation:

<Steps>
  <Step title="Extracts indicators">
    It reads the selected alerts and pulls out the indicators of compromise —
    IPs, domains, hashes, URLs, users, and hosts.
  </Step>

  <Step title="Attaches relevant context">
    It gathers related documents and reference material so the agent has the
    background it needs.
  </Step>

  <Step title="Selects the assets in play">
    It picks the devices and integrations connected to the detection, so the
    investigation can reach the right hosts and tools.
  </Step>

  <Step title="Composes a structured prompt">
    It writes a clear, SOC-shaped investigation prompt from everything it
    gathered — no blank page to fill in.
  </Step>
</Steps>

## What Happens Next

The composed investigation is handed to **Centurion's SOC variant** in the chat. From there it runs like any other conversation: the orchestrator coordinates specialists — [Orion](/documentation/multi-agent-system/orion) to enrich the indicators, [Perseus](/documentation/multi-agent-system/agent-endpoint-specialist) to inspect or act on an affected host — and you watch the reasoning and tool calls stream in live.

<Card title="Centurion, in SOC mode" icon="shield-halved" href="/documentation/multi-agent-system/agent-orchestrator">
  How the orchestrator runs a detection-and-response investigation end to end.
</Card>

<Note>
  The wizard gets an investigation moving fast, but it doesn't act on your
  environment by itself. Any response — isolating a host, blocking an indicator —
  is proposed in chat for you to approve. See
  [AI proposes, you approve](/documentation/get-started/concepts#ai-proposes-you-approve).
</Note>

## From Investigation to Record

Once the picture is clear, ask [Scribe](/documentation/multi-agent-system/scribe) to write the investigation up as a report you can share, or keep the conversation as your working record.