Investigation

Search raw intelligence, triage evidence, and build internal case work. Included Investigation covers recent human checks; an Investigation Slot unlocks historical search, API/MCP, and billable investigation capacity. Use Cyber Exposure for client-facing exposure reports.

Start an investigation

Search a domain, person, handle, email, wallet, breach, actor, or incident.

Time window

Searches retrieve evidence and use paid search capacity. Asking about loaded evidence is included.

Results

Run a search to begin.

Query Route

Waiting for authentication.

Status

Waiting for authentication.

Source	Finding	Seen	Action

No results yet.

Ask about loaded findings

Included with loaded evidence

Ask questions about the results already loaded in this case: origin, duplicates, provenance, infrastructure overlap, likely role, and what the evidence supports. New searches or wider evidence collection use paid search capacity.

Run a search to enable Ask.

Investigation workflows

Packaged paid workflows for credential/infostealer triage, breach-origin review, entity-role review, and incident pivots. Available with an active Investigation Slot.

Investigation Slot unlocks

An Investigation Slot reserves one of your existing CIH slots for 14 days. Each slot includes 20 evidence searches, historical search depth, API and MCP access, and the workflows below. Asking about already-loaded results does not use another search. Cyber Exposure remains the client-facing exposure and reporting product.

20 evidence searches per 14-day slot

Each new search, source change, or window change uses one evidence search. Asking about already-loaded findings does not.

Historical evidence search

180 days, 1 year, 2 years, 5 years, 7 years, 10 years, and all-time evidence retrieval for billable case work and DFIR support.

API and MCP access

Programmatic Investigation access for automation, agents, and downstream tooling — metered against the same slot capacity.

AI-assisted relevance ranking

Rank loaded raw results by analyst relevance with cited reasons — saves 10–30 minutes of manual triage on a noisy 100-row result set.

Semantic role classification

Classify each mention's role (real victim, actor, infrastructure, browsing context, fictional placeholder) before drawing exposure conclusions — prevents Suavecell-class false-positive incident calls.

Internal evidence summaries

Internal analyst summary of what was found and what was not, with row-level citations. Internal work-product only — Cyber Exposure remains the client-facing report path.

Area	Included Investigation	Investigation Slot
Purpose	Occasional recent checks	Paid investigation work
Best for	Quick recent triage	Billable client cases, DFIR support, actor pivots, credential triage
Slot usage	No slot used	Uses 1 existing CIH slot
Slot duration	Not applicable	14 days
Search allowance	30 searches per month per MSSP	20 evidence searches per slot
Burst limit	10 searches per hour per MSSP	None
Search window	Last 90 days	180 days, 1 year, 2 years, 5 years, 7 years, 10 years, all time
Ask about results	Not included	Included — asking about loaded evidence does not use another search
API access	Not included	Included
MCP / agent access	Not included	Included
Automation	Not included	Included, metered through slot capacity
Deduplication and clustering	Included	Included
Raw and dedup views	Included	Included
Source counts	Included	Included
Advanced filters	Basic	Full
Relevance ranking	Basic	AI-assisted
Case workflows	Visible as upgrade path	Included
Output	Recent raw evidence review	Internal investigation work product
Cyber Exposure handoff	Suggested when exposure reporting is needed	Suggested when findings should become monitored exposure
Main business value	Lets MSSPs run limited recent checks without using a slot	Helps MSSPs complete paid investigation work faster