---
title: Investigate Issues
description: >-
  Use Bits Investigation to automatically investigate monitor alerts and provide
  root cause analysis for faster incident resolution.
breadcrumbs: Docs > Bits AI > Bits Investigation > Investigate Issues
---

# Investigate Issues

{% callout %}
# Important note for users on the following Datadog sites: app.ddog-gov.com, us2.ddog-gov.com

{% alert level="danger" %}
This product is not supported for your selected [Datadog site](https://docs.datadoghq.com/getting_started/site.md). ({% placeholder "user-datadog-site-name" /%}).
{% /alert %}

{% /callout %}

## Start a Bits Investigation{% #start-a-bits-investigation %}

You can launch a Bits Investigation from several entry points:

- Monitor alerts, which you can trigger in two ways:
  - **Manual**: Start from an individual monitor alert
  - **Automatic**: Configure monitors to automatically launch a Bits investigation whenever they enter an alert state
- APM latency graphs on service pages
- APM latency Watchdog stories
- Synthetic test details page
- General prompt

### Monitor alerts{% #manual-monitor-alerts %}

You can invoke Bits on an individual monitor alert or warn event from several entry points:

#### Option 1: Bits Investigation Monitors list{% #monitor-list %}

1. Go to [Bits Investigation > Monitors > Supported](https://app.datadoghq.com/bits-ai/monitors/supported).
1. Click Investigate Recent Alerts and select an alert.

#### Option 2: Monitor status page{% #option-2-monitor-status-page %}

Navigate to the monitor status page of a Bits Investigation-supported monitor and click Investigate with Bits Investigation in the top-right corner.

#### Option 3: Monitor event side panel{% #option-3-monitor-event-side-panel %}

In the monitor event side panel of a Bits Investigation-supported monitor, click Investigate with Bits Investigation.

#### Option 4: Slack{% #option-4-slack %}

To use the Slack integration, [connect your Slack workspace to Bits Investigation](https://docs.datadoghq.com/bits_ai/bits_ai_sre/configure.md#slack).

In Slack, reply to a monitor notification with `@Datadog Investigate this alert`.

### APM latency (Preview){% #apm-latency-preview %}

{% callout %}
##### Join the Preview!

Bits Investigations started from APM latency graphs and APM Watchdog stories are in Preview. Click **Request Access** to join the Preview program.

[Request Access](http://datadoghq.com/product-preview/bits-ai-sre-pilot-features)
{% /callout %}

#### APM latency graphs on service pages{% #apm-latency-graphs-on-service-pages %}

1. In Datadog, navigate to [APM](https://app.datadoghq.com/apm/home) and open the service or resource page you want to investigate. Next to the latency graph, click Investigate.
1. Click and drag your cursor over the point plot visualization to make a rectangular selection over a region that shows unusual latency to seed the analysis. Initial diagnostics on the latency issue appear, including the observed user impact, anomalous tags contributing to the issue, and recent changes. For more information, see [APM Investigator](https://docs.datadoghq.com/tracing/guide/latency_investigator.md).
1. Click Investigate with Bits Investigation to run a deeper investigation.

#### APM latency Watchdog stories{% #apm-latency-watchdog-stories %}

On a Watchdog APM latency story, click Investigate with Bits Investigation.

### Synthetic tests (Preview){% #synthetic-tests-preview %}

{% alert level="info" %}
Bits Investigations started from Synthetic Browser and API tests are in Preview.
{% /alert %}

When a Synthetic Browser or API test monitor triggers, you can launch a Bits Investigation to identify the root cause. Bits Investigation analyzes Synthetic test results and history alongside traces, logs, and metrics. It surfaces a likely root cause and identifies whether the failure reflects a real regression or a misconfiguration.

#### From the Synthetic test details page{% #from-the-synthetic-test-details-page %}

1. On the [Synthetic Tests](https://app.datadoghq.com/synthetics/tests) page, open the Synthetic test you want to investigate and go to the Timeline section.
1. Select the Alert Triggered event for the failing test run.
1. Click Investigate with Bits Investigation.

The investigation opens in a new page, and you can also view it from the test details page after it runs.

#### From a Synthetic monitor{% #from-a-synthetic-monitor %}

Synthetic monitors support the same monitor-based entry points as other supported monitor types. See Monitor alerts for the available options, or toggle Auto-Investigate on a Synthetic monitor to start investigations automatically. For details, see Enable automatic investigations.

### General prompt (Preview){% #general-prompt-preview %}

Click on [New Investigation](https://app.datadoghq.com/bits-ai/investigations/new) and describe the issue you want to troubleshoot. Include as much relevant context as possible:

- Observed symptoms (e.g., errors, latency) including any links to Datadog telemetry that indicate this
- Relevant tags such as service, application, or environment that isolate the issue
- A time window (default is past 4 hours)

The more specific your prompt, the more accurate and useful the investigation will be.

Good examples:

- Investigate requests to search-service in prod. Some requests are returning empty results when they should not. The issue began around 10:00 UTC.
- Investigate what's causing these errors: [https://app.datadoghq.com/logs?query=service%3Asearch-service%20status%3Aerror](https://app.datadoghq.com/logs?query=service%3Asearch-service%20status%3Aerror) They started appearing about 5 minutes ago.

Bad example:

- App is slow. What's wrong?

You can also trigger an investigation from Slack. Mention Datadog in a message: `@Datadog Investigate high CPU in ai-gateway in prod over the last 30 minutes`. If invoked within a Slack thread, Bits Investigation automatically uses the entire thread as investigation context.

{% alert level="info" %}
Starting Bits Investigations from a prompt is in Preview for all customers. During this period, the number of investigations per day is rate-limited. This limit does not apply to generally available entry points, such as monitors.
{% /alert %}

### Enable automatic investigations{% #enable-automatic-investigations %}

In addition to manual investigations, you can configure Bits to run automatically when a monitor transitions to the alert state:

#### From the Bits Investigation Monitors list{% #from-the-bits-investigation-monitors-list %}

1. Go to [Bits Investigation > Monitors > Supported](https://app.datadoghq.com/bits-ai/monitors/supported).
1. Toggle Auto-Investigate on for a single monitor, or bulk-edit multiple monitors by selecting multiple monitors, then clicking Auto-Investigate All.

#### For a single monitor{% #for-a-single-monitor %}

1. Open the monitor's status page and click Edit.
1. Scroll to Configure notifications & automations and toggle Investigate with Bits Investigation.

{% alert level="info" %}

- Enabling automatic investigations using the Datadog API or Terraform is not supported.
- An investigation initiates when a monitor transitions to the alert state.
- Transitions to the warn or no data state, [renotifications](https://docs.datadoghq.com/monitors/notify.md#renotify), and test notifications do not trigger automatic investigations.

{% /alert %}

### Supported monitors{% #supported-monitors %}

Bits is able to run investigations on the following monitor types:

- Metric
- Anomaly
- Forecast
- Integration
- Outlier
- Logs
- APM (`APM Metrics` type only; `Trace Analytics` is not supported)
- Composites
- SLOs (Preview)
- Synthetics API and Browser tests (Preview)

## How Bits Investigation investigates{% #how-bits-investigation-investigates %}

When Bits Investigation investigates an issue, it operates in a continuous loop of observation, reasoning, and action. It begins by forming hypotheses about the potential root cause, then uses its tools to query telemetry data to validate or invalidate those hypotheses. Each step builds on prior findings. As new evidence emerges, Bits Investigation updates its understanding, refines its reasoning, and chains together additional investigative steps—adapting and course-correcting until it converges on the most likely root cause.

At the end of an investigation, Bits Investigation either presents a clear, evidence-backed conclusion or marks the investigation as inconclusive when the available data is insufficient to support a defensible conclusion.

{% image
   source="https://docs.dd-static.net/images/bits_ai/bits_ai_sre_investigation_hypotheses.388a74db896dcfc962a133b702e62bfa.png?auto=format&fit=max&w=850 1x, https://docs.dd-static.net/images/bits_ai/bits_ai_sre_investigation_hypotheses.388a74db896dcfc962a133b702e62bfa.png?auto=format&fit=max&w=850&dpr=2 2x"
   alt="Flowchart showing the hypotheses Bits Investigation built and tested" /%}

### Supported data sources{% #supported-data-sources %}

Bits uses the following data sources during investigations:

#### Datadog products{% #datadog-products %}

- Metrics
- APM traces
- Logs
- Dashboards
- Events
- [Change Tracking](https://docs.datadoghq.com/change_tracking.md)
- [Source code](https://docs.datadoghq.com/source_code.md#tag-your-apm-telemetry-with-git-information) (GitHub only)
- Watchdog
- Real User Monitoring
- Network Path
- Database Monitoring
- Continuous Profiler
Add service scoping: For monitors associated with a service, add a service tag to the monitor, or filter or group the monitor query by service. This helps Bits Investigation correlate data more accurately.
#### Third-party integrations{% #third-party-integrations %}

- Grafana
- Dynatrace
- Sentry
- Splunk
- ServiceNow
- Confluence

{% alert level="info" %}
Third-party integrations are in Preview for all customers.
{% /alert %}

For best practices on maximizing the effectiveness of investigations, see [Knowledge sources](https://docs.datadoghq.com/bits_ai/bits_ai_sre/knowledge_sources.md).

### Investigation display modes{% #investigation-display-modes %}

There are two display modes: Agent Trace and Investigation.

While an investigation is in progress, Bits captures every step it takes—including how it evaluates evidence and makes decisions—in the Agent Trace view. This provides a real-time, detailed record of the agent's reasoning process.

Once the investigation is complete, you can switch to the Investigation view to explore a structured, tree-based visualization of the investigative path, making it easier to understand findings and conclusions at a glance.

## Reports{% #reports %}

The Reports tab enables you to track the number of investigations run over time by monitor, user, service, and team. You can also track the mean time to conclusion to assess the impact of Bits Investigation on your on-call efficiency.

## Further reading{% #further-reading %}

- [Meet the new Bits Investigation: Deeper reasoning, twice as fast](https://www.datadoghq.com/blog/bits-ai-sre-deeper-reasoning)