Investigations
- Latest Dynatrace
- App
About the app
What you'll learn
- Define and execute queries while combining functionalities.
- Search for relevant log information.
- Grasp structured information from log records.
- Extract fields and get instant feedback on patterns.
- Track your path, navigate to previous steps, view your investigation history.
- Define the time range for your data queries.
- Attach relevant findings as evidence, while preserving the investigation context.
- Add reputation context to IP addresses with IP enrichment powered by third-party threat intelligence.
- Collaborate with peers on investigations using controlled access.
- Interact with compatible apps for further insights.
- Create and use lookup tables to enrich investigations with contextual data.
Target audience
Investigations supports a wide range of evidence-driven investigations, empowering users to explore, analyze, and resolve complex scenarios — across security, operations, compliance, and fraud.
It's ideal for:
-
Incident response
-
Root cause analysis
-
Threat hunting
-
Fraud investigations
-
Data forensics
Investigations is designed for anyone who needs to investigate and act on data with precision and context — including security analysts, SREs, DevOps engineers, operations teams, internal auditors, and more.
Prerequisites
-
To investigate ingested logs, you need to set up log ingestion.
-
Permissions: For a list of permissions required, go to Hub, select
Investigations, and display Technical information. -
Basic knowledge of
Investigations is designed to streamline evidence-driven investigations on data in Grail — whether you're resolving incidents, analyzing root causes, or conducting threat or fraud investigations, by
-
Eliminating manual, repetitive tasks
-
Providing contextual enrichment without tool-switching
-
Offering fast, detailed access to your data
-
Enhancing user experience for quick issue identification
It features assisted functionalities and automations to expedite and support investigation resolution, leveraging logs, metrics, and traces ingested into Grail.
To get started and create your first investigation scenario, open Investigations and select 
Investigation.
Try Investigations and share your feedback to help us improve.
Learning modules
- How-to guide
- Run investigations using Dynatrace Query Language in Investigations.
- How-to guide
- Narrow down data to relevant entries in Investigations.
- How-to guide
- Pull specific data points from logs in Investigations.
- How-to guide
- Adjust time ranges for data analysis and event correlation in Investigations.
- How-to guide
- Organize and interpret query outputs across investigations --- from performance analysis to threat detection.
- How-to guide
- Visualize and structure complex queries in Investigations.
- How-to guide
- Collect and preserve investigation artifacts in Investigations.
- How-to guide
- Share, duplicate, and control access to investigations across teams in Dynatrace Investigations.
- How-to guide
- Reuse common queries and workflows in Investigations.
- How-to guide
- Identify causes faster and smarter in Investigations.
- How-to guide
- Share insights and integrate Investigations with other Dynatrace apps and tools for deeper analysis.
Investigations