# Investigations

An **investigation** in Axiad Mesh is a drill-down. Starting from a
[workspace](../user-guide/generative-ui.md) widget, you click something — an
identity, a finding, a program, a step in an attack path — and Mesh opens a
**focus frame**: a full-screen view, composed of detail widgets, all scoped to
the one thing you clicked. Investigations aren't a separate feature you navigate
to; they're how you follow any risk from the summary down to the evidence.

## Drilling is deterministic

A drill is **not** an AI step. Clicking a specific place in a specific widget
maps to a pre-defined layout, and that layout dictates exactly which detail
widgets appear and how the subject and inherited filters flow into them. The
same click always opens the same investigation, and it opens fast — the language
model isn't invoked on a drill.

Because a focus frame has a stable, shareable URL, an investigation can be handed
off by link: bookmark it, paste it into a ticket, or drop it in chat, and the
recipient lands on the same drilled-in view.

## Investigating an identity

Drilling into an identity composes a focus frame with:

- **Identity summary** — name, state, correlation quality, risk score, loss
  exposure, and owner.
- **Open risks** — the identity's findings ranked by severity and confidence and
  tagged by [risk layer](./risk-scoring.md).
- **Correlated peers** — the accounts Mesh has correlated to this identity,
  ranked by similarity, showing where the correlation came from.
- **The identity graph** — the identity's relationships, drawn as a diagram
  (below).

### The identity graph

The identity graph is the **two-hop neighborhood** around one identity: the
identity itself, everything correlated to it, and everything correlated to
*those* — bounded so it stays fast and always draws the same graph for the same
identity. It's a force-directed diagram where nodes are colored by kind — human,
non-human identity, role, resource, group — and a legend labels them. Edges
represent [identity correlations](./identities.md) and carry a similarity
strength; an edge that lies on a **critical access path** is highlighted in red
and labeled so you can see how access chains together.

The graph is a fast way to answer "what else is this connected to, and does any
of it matter?" without leaving the investigation.

## Attack paths (the kill chain)

The **kill chain** widget shows your highest-exposure attack path as a
left-to-right numbered flow — for example *phishable MFA → session theft → token
replay → API access → privilege escalation → data exfiltration* — with the total
annual loss exposure of the path. It answers "if an attacker chained our
weaknesses together, what's the worst realistic route, and what would it cost?"

Drilling into a step opens that step's detail: the attacker technique it maps to,
its share of the exposure, the identities it affects, and a timeline of the
evidence behind it.

## Moving through an investigation

Every focus frame gives you the same controls:

- **Subject pill** — the thing you drilled into, shown in the header and
  editable. Retype it and the whole frame re-binds to the new subject — a quick
  pivot from one identity or finding to the next without going back to the
  canvas.
- **Inherited filters** — a frame carries in only the filters its layout
  declares (a time range, a department, a severity), marked as inherited;
  editing them affects the frame only.
- **Step back out** — the frame's Back button, the browser Back button, and the
  Escape key all close the frame and return you to the canvas exactly where you
  were. A breadcrumb trail lets you pop to any depth.
- **Keep it** — **Pin as workspace** turns the drilled-in view into a saved
  workspace; an admin can **Save as template** to make the drill layout reusable
  across the tenant.

## Related concepts

- [Identities](./identities.md) — the correlations the identity graph draws.
- [Risk scoring](./risk-scoring.md) — the scores and layers findings carry.
- [Remediation](./remediation.md) — acting on what an investigation surfaces.
- [Generative UI](../user-guide/generative-ui.md#working-with-a-workspace) — the
  workspace mechanics behind focus frames.