How SuperIT investigates a problem across a device, its history and your knowledge base, while you stay in control of every command it runs
When a problem needs more than one quick check, ask SuperIT to investigate it. An investigation looks across the device, its history, your knowledge base, the web and Microsoft 365, then writes a report of what it found. It's part of how engineers at MSPs and IT teams use SuperIT as a copilot.
An investigation runs in the background. SuperIT tells you it has started, and you can carry on with the conversation. When the report is ready, it arrives in the chat on its own.
At a glance
- Starts with a sentence: ask SuperIT to look into a problem.
- One approval per round: you approve a round of device commands together, not one by one.
- You choose what runs: switch off any command before you approve the round.
- A report with evidence: every finding is backed by the calls that produced it.
This page is about investigations you start in a chat. SuperIT can also investigate tickets on its own as part of ticket automation; those run without anyone in the chat and follow your ticket automation settings.
Start an investigation
Describe the problem in the chat, for example:
This laptop has been slow for a week. Investigate and tell me the most likely cause.
SuperIT starts an investigation, replies in one sentence that it's running, and shows an investigation card in the chat. You don't need to keep the window open.
How an investigation runs
An investigation works in rounds. Each round has three steps:
- Plan. SuperIT looks at what it already knows: the device's recorded history, your knowledge base, the web and, where connected, Microsoft 365. It then decides which commands to run on the device.
- Run. The approved commands run on the device through the SuperIT RMM agent.
- Decide. SuperIT reads the results and either writes its report or plans another round.
Lookups in the device history, knowledge base, web and Microsoft 365 happen while SuperIT plans. They never change anything.
Approve a round
Commands that need approval under your command policies are gathered into one approval card for the whole round, shown under the investigation card.
- Every command is listed with a tick box. Untick any command you don't want to run, then approve the round. A command you switch off stays off for the rest of the investigation.
- Declining the round skips every command that needed approval. Commands your policies already allow still run.
- Commands that run as SYSTEM are marked on the card, so you can see which ones run with elevated rights before you approve.
- Commands your policies allow run without a card, as they would anywhere else in SuperIT.
- Automatic command review: if automatic command review is on for your team, the AI reviewer may approve some eligible commands before the card appears. Anything it doesn't approve waits for you on the card.
SuperIT applies the same rules to an investigation's commands as to any command it runs:
- Commands your policies Deny never run, and SuperIT plans around them.
- Only an investigation started by an engineer or admin can run commands as SYSTEM.
The people who can approve commands for your team are notified when a round is waiting for approval. See Autonomy and approvals.
Follow its progress
The investigation card shows each round and its status as SuperIT works. Open the card to see the full plan in the side panel: what SuperIT looked up, which commands it ran and what it decided.
If a device goes offline, its commands fail straight away rather than waiting. A command that doesn't finish within its time limit is reported as timed out, and the report says whether it may still have run.
After three rounds
If an investigation reaches three rounds and SuperIT wants to keep going, it asks you first. The card offers two choices:
- Explore further: run one more round.
- Finish with what we have: write the report from what it has found so far.
You're notified when an investigation is waiting on this choice.
Read the report
When the investigation finishes, the report appears in the chat and SuperIT summarises it. Open the report to see:
- The findings, with every figure taken from a command or lookup that completed.
- What wasn't checked, such as commands you switched off, commands your policies denied, or commands that failed, with the reason for each.
- The ledger: every call the investigation made, in order, with what went in and what came back.
Common secrets, such as passwords and tokens, are masked in the ledger before it's stored or shown. Masking is best effort, so avoid asking SuperIT to look up secrets during an investigation.
Stop an investigation
Ask SuperIT to stop the investigation. It withdraws any approval card still waiting and any commands that haven't reached the device yet. Stopping the chat itself doesn't stop an investigation.
Who can see an investigation
An investigation is as visible as the chat it belongs to. Admins and engineers can see it. Other members can see it only if they're part of the conversation.