The investigation loop
The shape of an investigation from open to report. Every other page in this section is one step of it, closer up.
Start an investigation
Investigate sits at the top of the sidebar. It opens a dialog. There is no investigations page to visit first.
- 1
Pick what you are starting from
A wallet, a transfer or an alert. An investigation does not have to begin with an alert. A wallet or a transfer is just as good a starting point.
- 2
For a wallet, choose the chain and paste the address
Cogentic checks the format against that chain before the dialog submits. A Bitcoin address pasted under Ethereum fails here, before the investigation starts.
- 3
For a transfer, choose the chain and paste the transaction hash
Cogentic checks the format the same way.
- 4
For an alert, choose the vendor and type their alert id
Only vendors your organisation has connected appear in the list.
- 5
Open the case
The run starts straight away.
What happens before you see anything
Opening the case starts a run. The agent screens the subject against the vendors you have connected and pulls counterparty attribution and exposure. It resolves any customer who has declared the address. It writes what it found as findings, with the sources attached.
You do not wait on it. The case opens and fills in.
A case opens on its dossier. It carries the state of the investigation, what the agent has concluded so far and where the money went, so the first screen answers what this is and how urgent it is before you read anything else.
Transfers to an address attributed to a sanctioned entity
Over six days the customer sent 14 transfers to a cluster attributed to a sanctioned exchange. The amounts sit just under the reporting threshold, and no transfer was declared.
- 62%Known exchanges62%
- 24%Unattributed24%
- 14%Sanctioned entity14%
The data here is invented.
The header carries the case name, the risk and how long is left on the SLA.
Read what it found
The case has four tabs: Summary, Explorer, Reports and Audit log. Summary stacks its panels in a fixed order, running from what came in through to what you decided.
| Panel | What sits there |
|---|---|
| Alert details | The alert that opened the case, as the vendor sent it |
| Customers | Anyone who has declared one of these addresses |
| Addresses | Every wallet on the case |
| Linked transfers | What those wallets moved |
| Analysis | The agent's findings, with the sources behind each one |
| Decision | The form, or the decision already made |
While a case is open, the Decision form sits at the bottom of Summary, because you read before you decide. Once the case closes, the decision moves to the top and appears as a strip above the case header.
The first question anyone asks about a closed case is what was decided and why, so the answer sits above everything that led to it. Reopening the case moves the form back to the bottom and the strip disappears.
The data here is invented.
On a closed case the decision sits above everything that led to it.
Check the agent’s working
Click any source on a finding. You see the request that went to the vendor and the response that came back, not the agent's summary of it.
Add what the agent could not reach
Some things are not onchain and no vendor sells them. A bank statement, a letter from the customer, a phone call you made. Put them on the case yourself.
- 1
Upload a document
The agent can cite it, and a finding citing your document is graded evidence.
- 2
Add a note
For context rather than evidence. A note is part of the case and stays with it.
Trace transfers in the Explorer
The Explorer tab draws the wallets and the transfers between them. Select a wallet to see its balance and what moved through it.
Decide
Five outcomes, grouped as Resolve and Continue investigating
- Close — false positive
A false positive. The case closes with your reasoning on it.
- Escalate to SAR
The case closes and a report draft is started from it. See Draft the report below.
- Escalate to a reviewer
Hand it to a named reviewer. Choosing this reveals the picker. The case stays open.
- Request for information
You are waiting on someone. The case stays open.
- Hold
You are waiting on something that is not a person. The case stays open.
The Decision panel sits at the bottom of Summary. Above the form, the agent puts a recommendation: a proposed outcome, its reasoning and the findings that reasoning rests on. Every finding it cites opens, so you can check each claim.
Draft the report
- 1
Pick a template
Templates are configured by your organisation.
- 2
Review the prefilled fields
Customers, wallets, transfers and dates come across from the case. Check each one.
- 3
Attach what belongs in the report
Attach only the documents and transfers the report needs.
- 4
Submit it
Then download it or link it to the case.
Related
What the agent does on a case
Each stage of an investigation, and what the agent produces at it.
How to run a case
How to scope an investigation, what order to establish facts in and how to tell when you have enough.
Deciding a case
Only a case's assignee can record an outcome, and two of the five end the case for good.
Last checked against the product on .