Investigate with Customer Detective

Customer Detective is Anectico’s hosted investigation assistant. It gathers relevant telemetry, explains what it found, and links claims back to evidence in your project.

Start from the right place

Use Investigate for an organization or project question. Use Explain this person on a customer or the Detective action on an Issue when you already know the investigation anchor.

The current project, environment, and time range limit what Detective can retrieve. Investigations started from a customer, Issue, or account keep that active project on their saved anchor. The Recent investigations list on Investigate shows saved investigations of every anchor type from the active project, newest first, so a customer investigation remains available after you leave the customer page.

Ask a bounded question

Good questions include a customer, symptom, journey, or time boundary:

• “Why did checkout failures increase after the last release?”
• “What happened to buyer@acme.example this morning?”
• “Are errors, latency, and logs pointing to the same service?”
• “Which customers are driving LLM spend this week, and why?”

Avoid prompts such as “Is everything okay?” They force a broad search and produce a less useful answer.

For a project question, Detective searches the selected window and also checks the most recent matching Issue as a bounded fallback. When an Issue has a trace, Detective follows that exact trace to retrieve its spans, trace-linked logs (including structured attributes such as a request ID), and the service metrics recorded around the occurrence. This lets a request- or customer-specific question stay grounded even when the Issue message does not contain the words used in the prompt.

Read citations as part of the answer

Each important claim should cite an Issue, trace, log set, metric, replay, customer, account, or agent run. Open the citation and confirm:

• it belongs to the expected project and environment;
• its timestamp is inside the investigation window; and
• the evidence actually supports the conclusion.

For a customer investigation, a log is associated with a trace only when both appear as retrieved evidence with the same trace ID. Detective exposes separate log and trace citations for that exact relationship. A nearby log with similar wording is not treated as trace evidence.

Only evidence validated by Anectico becomes a clickable citation. Unresolved or truncated citation tokens are hidden without removing the surrounding explanation; they are never shown as raw identifiers or presented as evidence.

Treat release timing carefully: “after the rollout” establishes sequence, not cause. Detective labels a rollout attribution as Inference unless the cited evidence states the mechanism that connected that release to the failure.

Detective helps assemble evidence; it does not replace engineering judgment.

Ask follow-up questions

Keep follow-ups within the same investigation when they depend on earlier context. Start a new investigation when changing project, environment, customer, or incident.

If two clients start the same investigation or submit the same follow-up at the same time, Anectico accepts exactly one. A duplicate Start receives the accepted investigation id so it can resume that result; a duplicate follow-up receives an in-progress response and can retry after the accepted turn finishes. Neither path creates a duplicate answer or consumes a second investigation from the plan allowance.

The dashboard keeps a long-running investigation session active when its short-lived access token expires. If expiry happens before a new opening or follow-up stream starts, Anectico rotates the HttpOnly refresh credential and retries that request once; the prior turn remains visible and the follow-up is not duplicated.

Stop and resume a long-running answer

Select Stop live view to stop receiving the current streamed answer in the browser. If Anectico has already confirmed the investigation, server-side production continues and is saved exactly once; the partial text is labeled Incomplete answer and must not be treated as a conclusion.

Select View result to reconnect to that same saved turn. Anectico polls the existing investigation instead of asking the question again, so this action does not create a duplicate turn or a second AI usage charge. Reloading a linked Investigate page resumes the same way. If the live view stopped before Anectico confirmed a durable investigation, the dashboard does not guess at an older turn; Start again creates a new request.

When no answer is possible

A grounded “not enough evidence” result is preferable to a guess. Check whether the relevant signal was ingested, sampled, retained, and connected to identity. Use No data is appearing when the evidence itself is absent.

If the AI provider is temporarily unavailable, Detective saves the failed turn and shows the same safe message when you return to or reload the investigation. Provider responses, credentials, and other upstream details are never included in that restored message; retry after service recovers.