Investigations
When security, HR or legal needs to know what someone sent to an AI service and what came back, ANTS Platform gives you three things in one place: a search across AI interactions, the full conversation behind any result, and cases to collect and track the evidence.
Search runs on Discover AI > Tracing. Listing traces needs the Tracing & Sessions permission, and opening their prompt and response content needs the content permission (pii:read), which Owner and Security & Compliance have among the built-in roles. See Members & Roles.
Search interactions
Use the filters on the trace table to narrow interactions down:
| Search by | How |
|---|---|
| User | A User ID filter, or the IDs / Names search mode, which matches user IDs. |
| AI service | The AI service filter: a text match on the name of the agent or AI service that produced the trace, for example "contains" a name. Only traces received after your deployment was upgraded to platform release v0.1.302 carry it; older traces do not match. |
| Data classification | The Has PII, Has PCI and Has PHI filters: traces where AI Guardrails found personal, payment card or health data. |
| Detections | The Bias flagged and Jailbreak flagged filters: traces flagged for ethics and bias, or for jailbreak or prompt injection. |
| Time range | The date range, from 30 minutes to All time. |
| Free text | The Full Text search mode, which also searches prompt and response content. |
Filters combine, so one search can answer "which requests containing payment data did this user send to this AI service last month?". Save the result as a table view to come back to it or share it with a colleague.
The data classification and detection filters come from AI Guardrails. A trace that guardrails have not checked does not match them. Turn on detection for the agents you need to investigate; see PII Detection.
How far back you can search follows the organization's data retention setting: from 30 days to 7 years, or indefinite.
Activity from the Discover AI browser extension and desktop agents is searched on the Discover AI pages, by AI tool, category, department, user and time. See Understanding the Discover AI Dashboard.
Tie a trace to the person in your identity provider
When Directory Integration is connected, a trace carries the stable ID of the person behind it in your identity provider whenever ANTS Platform can match that person: the Okta user ID for Okta, or the Entra object ID for Microsoft Entra ID. It stays the same when an email address changes, so HR, legal and SIEM searches can key on the same ID as your other security tools.
- The trace page shows it as an IdP user ID badge next to the user ID.
- Trace and observation exports, blob storage exports and SIEM push events include it.
- It is filled as traces arrive. Traces received before your deployment was upgraded to platform release v0.1.302 have no value.
How the ID is matched to a person is described in Identity provider user ID on records.
Reconstruct a session
Find the interaction
Filter the trace table until you find the request you are looking for.
Open it
Select the row to open the trace with its input, output and every step that produced the answer.
Open the session
Select the session badge on the trace. The session shows every trace in the conversation in time order, with input and output, so you can read the whole multi-turn exchange.
When your ANTS deployment has content view auditing turned on, every trace and session you open is recorded in the audit log as a content view. See Content view audit.
Cases
A case groups the traces, sessions and observations behind one investigation, with a status, an owner, tags and notes. Open the case list from Discover AI → Investigations.
Seeing cases and exporting them needs the Tracing & Sessions permission at Read, which Owner, Department Admin, Security & Compliance and Auditor have. Creating cases, changing them and adding items need Read & Write, which Owner and Security & Compliance have. Reading the content of the items still needs the content permission (pii:read). Investigations is on by default; an organization admin can turn it off with Investigations in Organization Settings → Features. Turning it off hides the page and the Add to case controls and keeps every case; turning it back on restores them.
Create a case
On Investigations, select New case. In the side sheet, enter the Name and an optional Description, and set the Status, Owner and Tags. Under Advanced Settings you can assign users to the case. Select Create.
Add evidence
On a trace, session or observation, select Add to case and pick the case. In the Tracing and Sessions tables, select rows and choose Add to Case from the bulk actions; the items are added in the background. You can also add a trace from its detail panel in AI Violations. A toast confirms each change. Items already in a case show In case(s).
Work the case
Open the case and select Review case to go through its items one at a time. For each item, add your notes as comments, then select Complete (or Complete + Next). Notes are the comments on that trace, session or observation, so everyone who opens the item sees them.
Close it
Set Status to Closed in the Case panel when the investigation is done.
| Field | Values |
|---|---|
| Status | Open (default), In progress or Closed |
| Owner | One member of the organization with access to the project, or Unassigned |
| Tags | Up to 20, each up to 50 characters. Type a tag and press Enter or a comma; duplicates are ignored. |
The case list shows each case with its Status, Owner, Tags, how many items are Reviewed, and when it was Created. Its row menu has Edit, Export CSV, Export JSON and Delete. On a case's page, the Case panel shows the status, owner and tags as controls that save as soon as you change them, and Export evidence. Every case change is written to the audit log.
Cases are not scored. Score configs are optional and are not shown in Investigations.
Export a case
Export CSV and Export JSON download one row per item: the case name, status, owner and tags, the item's type and ID, whether it was reviewed and by whom, when it was added and completed, and its notes. An export includes up to 10,000 items and is written to the audit log with action export. It contains no prompt or response content; export the traces and sessions themselves for that (see Evidence handling).
If your cases run in ServiceNow, detections can also open ServiceNow incidents automatically. See AI Violations.
Evidence handling
- Content access: with content view auditing on, opening a trace or session records who read its prompt and response content, once per person per trace or session in any 5 minutes. If the entry cannot be written, the content is not shown. Review it with the Content views only switch on the Audit Logs page in Organization Settings. Content view auditing is off by default; your ANTS deployment must have it turned on, so ask your ANTS administrator. See Content view audit.
- Exports: every table and audit log export file has a SHA-256 checksum, and every download is recorded with the user, the time and the file. See Verify an export.
- Content exports: exports of traces, observations, sessions, dataset items and dataset run items need the content permission (
pii:read) as well as data export access. Only Owner has both, and a custom role cannot combine them (see separation of duties), so case evidence exports are made by an Owner. See Data Exports. - Public API: when a project hides prompt content, the traces, observations and sessions endpoints return
nullinput and output. See Data Privacy.
Legal hold and hashing of each record at capture are on the roadmap.
Next steps
- Traces & Observations: every search and filter control.
- Sessions: the conversation view.
- Audit Logs: content views and export downloads.
- Data Privacy: who can read and export prompt content.