> ## Documentation Index > Fetch the complete documentation index at: https://docs.aiaxoniq.com/llms.txt > Use this file to discover all available pages before exploring further. # AI Assistant and Investigate > The AI Assistant section page by page — Investigate, Ask your data, Root cause, Suggested fixes, Correlation, Knowledge base and Insight history — what each needs, and what you see when no model is configured. The **AI Assistant** section of the dashboard groups every page that asks the AI service for an answer. It is marked **beta** in the sidebar. Most of these pages need a language model. A model is configured by whoever operates your deployment, not per user — so on some deployments every page works, and on others several pages explain that a prerequisite is missing. This page tells you which is which. **Before you start.** You need to be signed in with any role, and your organization needs telemetry arriving — see [Send data with OpenTelemetry](/send-data/otel/collector). Whether a model provider is configured depends on your plan and deployment. If you operate aiAxonIQ yourself, see [Configuring AI providers](/guides/ai/configuration). This page covers the Assistant section. Anomaly detection, forecasting and suggested alert rules and SLOs are described in [AI features](/guides/ai/overview). ## What each page needs The **Assistant** landing page lists every page below with one line on what it does and what it needs. It makes no call of its own: it states requirements rather than guessing at your configuration, and a page whose prerequisite is missing says so when you use it. | Page | What it does | Needs | | :------------------ | :--------------------------------------------------------------------------------------------- | :-------------------------------------------------------------------------------- | | **Investigate** | Runs an investigation agent over your organization's telemetry and shows the evidence it used. | A language model | | **Ask your data** | Turns a question into a read-only query over your organization's data. | A language model, and the AI service's per-organization query identity | | **Root cause** | Summarises a pasted failure into a probable cause, severity and summary. | A language model | | **Suggested fixes** | Recommends actions for a pasted failure. | A language model. The matching runbooks beside them also need an embedding model. | | **Correlation** | Finds indexed incidents whose text resembles a pasted failure. | An embedding model | | **Knowledge base** | Stores and searches runbooks and past resolutions. | An embedding model | | **Insight history** | Lists earlier Root cause and runbook answers saved for your organization. | Nothing | "An embedding model" is narrower than "a language model": today the only embedding model the AI service uses is OpenAI's, so Correlation and Knowledge base work only on deployments configured with OpenAI as the provider. **Anomaly detection and forecasting need no model at all.** They are statistical and run on every deployment where the AI service is reachable — including anomaly alert rules. See [AI features](/guides/ai/overview). ## Investigate Ask a question about production in plain language — *why did checkout latency increase?* — and an agent works through it one step at a time: it chooses a tool, reads what the tool returns, and decides what to look at next, until it can answer or runs out of budget. In the sidebar, open **AI Assistant → Investigate**. You can also run the **Investigate a problem** command from the command palette. Type your question and press **Investigate** (or Enter; Shift+Enter adds a line). Suggested questions appear under the box until a run starts. A question is limited to **8,000 characters** — the box tells you before you reach it. The agent chooses its own time window and is scoped to your organization; you cannot point it at another one. The page shows the investigation as it happens. Nothing about the run depends on your browser tab: if you reload, or the connection drops, the page rejoins the same run. Each run gets its own address (`/assistant/investigate/`) as soon as it starts, so a reload returns you to it and you can send the link to a colleague in the same organization. A link to a run in another organization, or to one that does not exist, shows **This investigation is not available** — the two are deliberately indistinguishable. **Investigations also start on their own.** When an alert opens an incident, aiAxonIQ starts one investigation for that incident with the same agent, tools and limits, authorised as a **Viewer**. It cannot ask anyone a question or wait for an approval. The dashboard does not list these investigations yet, so there is no page today from which to open one. ### What an investigation shows | Panel | What it tells you | | :------------------------- | :-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Summary** | What the run did (its status) and what the investigation found (its conclusion), kept separate — a run can stop at its budget *and* have reached a conclusion. | | **Investigation** | The plan the agent stated (**What it intends to look at**), then every tool call it actually made with its status, and a count such as *6 of 6 tool calls · step 4 of 12*. | | **Answer** | The conclusion, headed **Root cause**, **No supported conclusion** or **Investigation incomplete**, with a **high / medium / low confidence** badge. Citation markers such as `E1` link to the evidence they rest on. | | **Hypotheses** | The explanations the run considered and which it ruled out. | | **Impact** | Which other entities the incident reached. | | **Investigation timeline** | What the run did, in order — its start and end, each tool call, and each change to a hypothesis — from recorded timestamps only. | | **Evidence** | Every observation the tools returned — the value read, its movement against a baseline, and, where the product has a screen for it, a link to the raw data. | | **Investigation coverage** | How much the run looked at. Kept apart from Impact so "four entities examined" is not read as "four entities affected". | | **Tools offered** | The tools this run was allowed to use — so "why did it never check X" has an answer. | Hypotheses, impact, the timeline and coverage appear once the finished run has been read back; while a run is live they may be absent. ### How to read the answer The confidence level and the verdict are **computed from the evidence**, not reported by the model. After the agent proposes an answer, every claim in it is checked against the evidence the tools actually returned: * A claim that cites evidence no tool produced is **dropped**. The page says so: *2 proposed claims did not survive validation and are not shown above.* * A causal claim resting on only one kind of evidence is not published. The answer can still describe what was observed, with no root cause — which is the honest shape of "here is what we saw, and we cannot say why". * **No supported conclusion** is a result, not a failure: the signals were checked and none explains the symptom. **Investigation incomplete** means the run stopped before it could conclude — a different answer, and the one that means *keep looking*. * Confidence is shown as a word and a three-step bar, never a percentage, because only three levels exist. **Treat an answer as a lead to verify.** The evidence cards are there so you can check the conclusion in two clicks — open the linked data and confirm the number yourself before acting on it. If the run hits a limit, the answer says *The run hit its budget before finishing. This is what it had concluded by then.* The limits are described in [How the investigation agent is governed](/guides/ai/agent-governance). ### Approvals and questions Two panels can appear above the activity, and the run waits on each: * **The agent needs an answer** — it asked you a clarifying question. Reply and the run continues. * **Approval required** — a tool call that needs a person's approval. Today no tool needs one (every registered tool is read-only), so you should not see this panel. How approvals work when one does is described in [How the investigation agent is governed](/guides/ai/agent-governance#tool-classes-and-approvals). ## Ask your data Type a question — *which services had the most errors in the last hour?* — and press **Ask**. The page shows the **Generated query** first, with the row count and execution time, and the results below it in a table you can search, sort and download. The query runs as a per-organization database identity, so it cannot read another organization's data whatever the model writes. **Read the generated query before trusting the number.** The failure mode is a plausible query that answers a slightly different question. If a query ran and matched nothing, the page says *The SQL above ran successfully and matched nothing* — that is an empty result, not an error. ## Root cause Paste a stack trace, error message or log lines into **Error or log snippet**, optionally name the **Service**, and submit. The answer has a severity, a **Summary**, a **Proposed root cause** and **Recommended actions**. Unlike Investigate, Root cause reads nothing but what you pasted — it does not query your telemetry. Every answer ends with *Generated by \. Treat it as a lead to verify, not as a finding.* Each analysis is saved to **Insight history**. ## Suggested fixes Paste the failure into **What is failing** and choose **Suggest fixes**. Two things are asked at once: * **Recommended actions**, reasoned from your snippet by the language model. * **From your runbooks** — matching entries from your Knowledge base. This half needs an embedding model; without one the page says **Semantic ranking is unavailable** beside the actions rather than silently showing no runbooks. If one half fails, the other is still shown. Runbook suggestions are saved to **Insight history**. ## Correlation Paste a failure and choose **Find related incidents** to search the incidents indexed in your Knowledge base for ones whose text resembles it. **This is similarity, not causation** — the page says so above the form. A high score means someone wrote something similar before, not that the two incidents share a cause. A similarity score is shown only when an embedding model ranked the result. ## Knowledge base **Search** your indexed runbooks and past resolutions, and **Add an entry** with a **Title** and **Content** (what happened, how it was diagnosed, and what fixed it). **Adding an entry requires the Editor role or higher**, because an entry is retrievable by everyone in your organization. Do not add anything you would not show every member. See [Roles and permissions](/concepts/roles). Without an embedding model the Knowledge base neither ranks nor stores entries: the page shows **Semantic ranking is unavailable** and explains that results could otherwise only be ordered by a hash of their text, which is not similarity. ## Insight history A table of earlier **Root cause analysis** and **Runbook suggestion** results for your organization, with when each ran and for which service. **View** shows the saved result exactly as the AI service produced it. It needs no model; it is empty until Root cause or Suggested fixes has run. Investigations are not listed here — each has its own address under **Investigate**. ## When no model is configured The pages do not work around a missing prerequisite, and none of them shows invented or sample output. What you see instead: | Page | What you see | | :------------------------------------------------------------------- | :----------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Investigate** | The run starts, then ends as failed with *The AI service could not be reached. The investigation stopped without an answer.* and the code `llm_unavailable`. | | **Root cause**, **Suggested fixes**, **Ask your data** | **Could not analyse this** / **Could not suggest fixes** / **Could not answer that**, with the reason the AI service gave — that no model key is configured. | | **Correlation**, **Knowledge base**, runbooks in **Suggested fixes** | **Semantic ranking is unavailable**, explaining that an embedding model is required. | | **Insight history** | Works normally. | If the AI service itself cannot be reached, the task pages say *The AI service is not reachable from this deployment. Everything else in the product is unaffected.* — and it is: every other section works without it. **Investigate's failure message says "could not be reached" even when the service is up and simply has no model configured.** Both cases end the run with `llm_unavailable`. If Root cause on the same deployment reports that no model key is configured, that is the cause. ## Troubleshooting Starting investigations is limited per organization: **20 per minute**, and a cap on how many run at the same time. The error is shown with a **Try again** button. The concurrent cap clears as a running investigation finishes. The validation step runs in the AI service. If it cannot be reached, the run fails rather than publishing an answer nobody checked. The page says *The connection dropped. Rejoining the run — nothing above is lost, and the agent kept going.* Wait, or reload: the run continues on the server either way. *Nothing validated this answer, so it carries no verdict and no confidence* means the answer was not checked against the evidence. Treat it as the model's account of what it found, not as a checked conclusion. ## Limitations * **A model can be wrong.** Validation stops the agent from citing evidence it never retrieved; it does not make its reasoning correct. The evidence is there so you can check. * **An investigation sees only what your organization sends.** If a service sends no traces, the agent cannot reason from traces, and the coverage panel shows what it looked at. * **There is no Stop button on the Investigate page today.** A run ends when it answers, fails, or reaches one of its limits; its time budget is five minutes. * **Answers arrive in chunks, not word by word.** * **Root cause, Suggested fixes and Correlation read only what you paste.** Investigate is the page that queries your telemetry. ## Next Read-only tools, tenant scoping, limits and the audit trail. For operators: which providers work and how to check. Anomaly detection, forecasting and suggestions.