---
title: "Configure alert-triggered investigations | Grafana Cloud documentation"
description: "Control how alert notifications create and continue Grafana Assistant investigations."
---

> For a curated documentation index, see [llms.txt](/llms.txt). For the complete documentation index, see [llms-full.txt](/llms-full.txt).

# Configure investigation settings

The Investigations settings page groups organization-wide behavior, alert enrichment, IRM behavior, tool approvals, and IRM webhooks. Investigation usage limits are managed on the Usage page.

## Before you begin

You need the **Assistant Admin** role to change these settings. Creating or managing alert enrichments also requires the Grafana **Alert Enrichments Writer** permission. Other users can view them.

## Manage investigation automations

Investigation automations schedule recurring follow-up checks within an investigation. Manage them from the investigation’s **Automations** overview or with `/schedule` in Workspace. For availability, intervals, and stop limits, refer to [Keep checking with automations](/docs/grafana-cloud/platform/grafana-assistant/platform/investigation/#keep-checking-with-automations).

## Change how alert updates continue investigations

When you enable investigation enrichment on your alerts, the Assistant starts an investigation when an alert group fires. Repeat notifications with no alert changes are ignored, and changes to the group continue the investigation that already ran, updating its report.

1. Navigate to **Assistant** > **Settings** > **Investigations**.
2. In **Alert enrichment**, review **Investigation trigger scope** to see which alerts can start investigations and the number of matching notification groups from the last seven days. Select **Add enrichment** to create another enrichment with a name, severity, and exact-match labels. Use **Filter by name or scope label** to find existing enrichments, and select **Show more** to load more configurations. To use annotation, rule, receiver, or other custom scopes, select **Manage in Alerting**. Avoid **All alerts** because automatic investigations consume investigation usage.
3. Configure the alert settings:
   
   - **Continue investigations on alert updates**: When on, an alert change after an investigation completes is added to that investigation’s context and may continue it if the changes are significant. When off, completed investigations no longer receive alert updates, which limits inference cost. New alert groups still create investigations either way.
   - **Continuation window**: How long after an investigation is created that alert changes still continue it instead of starting a new investigation. Set this to at least your notification policy’s repeat interval so a still-firing alert continues its original investigation. The default is 6 hours.

## Limit new alert investigations

Severity limit rules protect against a burst of alert groups starting too many investigations. Alert enrichment and IRM alert webhooks have separate limits, so one source doesn’t consume the other’s capacity.

1. Navigate to **Assistant** > **Settings** > **Investigations**.
2. In **Alert enrichment**, add, edit, or remove a rule under **Alert investigation limits**.
3. Choose **All** or a specific severity, the maximum number of new investigations, and a time window from 5 minutes to 24 hours.

The **All** rule is a shared limit for severities without their own rule. A severity-specific rule overrides **All** instead of counting against both limits. Without **All**, a severity with no rule is unlimited. By default, **All** limits alert enrichment to 50 new investigations per 20 minutes.

Alert enrichment limits apply only to automatically created investigations. Updates to an existing alert investigation and manual starts don’t count.

## Change how IRM updates continue investigations

In **IRM behavior**, configure **Continue investigations on IRM updates**. When on, a change to an IRM incident or alert group after its investigation completes resumes that investigation with the update. When off, completed investigations no longer resume on IRM updates. New incidents and alert groups still create investigations either way. This setting is independent of **Continue investigations on alert updates**.

Under **IRM alert investigation limits**, configure how many new investigations IRM alert-group webhooks can create. The rules use the same severity, **All**, maximum, and window behavior as alert enrichment, with a separate default of 50 new investigations per 20 minutes. Alert-group updates and IRM incident webhooks don’t count.

## Configure IRM webhooks

IRM webhook configuration also lives on the Investigations settings page. For details, refer to [Configure IRM webhooks](/docs/grafana-cloud/platform/grafana-assistant/configure/irm-webhooks).

## Next steps

- [Automate investigations with IRM webhooks](/docs/grafana-cloud/platform/grafana-assistant/configure/irm-webhooks)
- [Manage access (RBAC)](/docs/grafana-cloud/platform/grafana-assistant/privacy-and-security/rbac)