# Investigation

Investigation allows you to create cases that group files requiring further review. Each investigation maintains a record of which files were examined, by whom, and any comments added during the review process, providing an audit trail for compliance purposes.

Within an investigation case, you can tag detected sensitive data as **Important** or **Not Important**, review previous comments, and download password-protected files as a ZIP for analysis outside of GuardWare.

<figure><img src="/files/uaGA8iVhzcHWIjRGzjoe" alt="" width="563"><figcaption></figcaption></figure>

<table><thead><tr><th width="147">Field Group</th><th width="171">Field</th><th>Description / Details</th></tr></thead><tbody><tr><td>Scan Details</td><td>Scan Name</td><td>Name of the scan job.</td></tr><tr><td></td><td>Scan Date</td><td>Date the scan job was executed.</td></tr><tr><td>File Details</td><td>File Name</td><td>Name of the file where sensitive data was found.</td></tr><tr><td></td><td>Folder Path</td><td>Path of the file that contains the sensitive data.</td></tr><tr><td></td><td>File Owner</td><td>Name of the file owner.</td></tr><tr><td>Endpoint / Data Source</td><td>Target Name</td><td>Device or service name where the scan was executed. Endpoint and data source are the same in this context.</td></tr><tr><td>Scan Results</td><td>Data Types</td><td>List of sensitive data types found by the scan job. Click to view details.</td></tr><tr><td>Remediation Action</td><td>Action</td><td>Action performed on the file (e.g., move, copy, delete, or notify device/file owner).</td></tr><tr><td>Download / Investigation</td><td>Download Status</td><td>Status indicating whether the file is available for download: -Available: File is available for download.Not Available: File is unavailable for download currently.</td></tr><tr><td></td><td>Investigation</td><td>Action to make the file available for download for manual examination of sensitive data.</td></tr><tr><td></td><td>Investigated By</td><td>Name of the user who performed the investigation.</td></tr><tr><td></td><td>Investigated At</td><td>Timestamp when the investigation was initiated.</td></tr><tr><td></td><td>Investigation Available At</td><td>Timestamp when the file became available for download. Always later than Investigated At.</td></tr><tr><td></td><td>Previous Comment</td><td>Comments from previous investigations.</td></tr></tbody></table>

### Create New Investigation

Before performing any [**file-level examinations**](/discover/investigate-and-remediate/results.md#investigate) in the Results page, you must first create an Investigation. Each investigation group related files together for review, tracks examiner activities, and stores comments made during the investigation process.

![](/files/6084c6d2d98fbbbd78f1dc1296dc4254fc3cfb0b)

1. Navigate to **DISCOVER** > **Investigation** and click **+Investigation.**
2. Enter a unique **Name** and add a short **Purpose**.
3. Click **Create**.

### View Investigations

View Investigation shows a searchable record of all investigations.

1. Navigate to **DISCOVER** > **Investigation** and click <i class="fa-eye">:eye:</i> **View Investigations**.
2. Search for or select an investigation from the dropdown.
3. Review the investigation details, including its name, purpose, creation date, and who created it.


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.guardware.com/discover/investigate-and-remediate/investigation.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.