WEBVTT 00:00:00.030 --> 00:00:04.780 position:50% align:center size:88% Let's read one recorded investigation and export its saved report. 00:00:04.830 --> 00:00:08.307 position:50% align:center size:88% We'll connect the conclusion to the evidence kept in its tool trace. 00:00:08.787 --> 00:00:11.787 position:50% align:center size:88% Start with the filtered list of recorded incidents. 00:00:11.862 --> 00:00:15.187 position:50% align:center size:88% Open the original checkout case from October first. 00:00:15.237 --> 00:00:19.762 position:50% align:center size:88% The incident is marked resolved, but closure needs supporting evidence. 00:00:19.812 --> 00:00:24.212 position:50% align:center size:88% We'll keep its original dates and one selected investigation in view. 00:00:24.287 --> 00:00:27.966 position:50% align:center size:88% This walkthrough reads saved history in the current interface. 00:00:29.680 --> 00:00:33.255 position:50% align:center size:88% Open Triage and locate the completed investigation. 00:00:33.330 --> 00:00:36.305 position:50% align:center size:88% This run contains ten recorded tool calls. 00:00:36.380 --> 00:00:39.430 position:50% align:center size:88% It finished before the incident was marked resolved. 00:00:39.505 --> 00:00:42.880 position:50% align:center size:88% Read its time and status before moving to the report. 00:00:42.930 --> 00:00:47.755 position:50% align:center size:88% The pipeline separates saved analysis from later operational outcomes. 00:00:47.830 --> 00:00:51.483 position:50% align:center size:88% Keep this run selected as we compare the report and trace. 00:00:53.920 --> 00:00:57.145 position:50% align:center size:88% Open RCA and read the conclusion for this run. 00:00:57.220 --> 00:01:01.270 position:50% align:center size:88% The report attributes the checkout failure to a removed ingress rule. 00:01:01.345 --> 00:01:05.420 position:50% align:center size:88% It places that change forty minutes before the recorded error onset. 00:01:05.520 --> 00:01:09.345 position:50% align:center size:88% Read the supporting evidence and the confidence beside that conclusion. 00:01:09.420 --> 00:01:13.545 position:50% align:center size:88% Confidence is an assessment of the answer, not measured accuracy. 00:01:13.620 --> 00:01:18.069 position:50% align:center size:88% The four later rechecks are Uncertain, so recovery remains unverified. 00:01:20.120 --> 00:01:23.220 position:50% align:center size:88% Return to Triage and open the recorded trace. 00:01:23.295 --> 00:01:26.695 position:50% align:center size:88% Expand the change lookup call that supports the report. 00:01:26.770 --> 00:01:31.145 position:50% align:center size:88% Its result records the ingress rule removal before the alert began. 00:01:31.220 --> 00:01:34.695 position:50% align:center size:88% The event time matches the timing cited in the report. 00:01:34.745 --> 00:01:38.745 position:50% align:center size:88% The before-state is reported, not a captured restore image. 00:01:38.820 --> 00:01:42.456 position:50% align:center size:88% Opening this saved observation does not run the tool again. 00:01:44.240 --> 00:01:47.915 position:50% align:center size:88% Return to the incident header and choose Export RCA. 00:01:48.015 --> 00:01:52.640 position:50% align:center size:88% This saves or returns an export of the latest recorded report. 00:01:52.715 --> 00:01:57.290 position:50% align:center size:88% It does not start another investigation or apply the proposed fix. 00:01:57.365 --> 00:02:01.065 position:50% align:center size:88% Keep the result tied to the same report we have just reviewed. 00:02:01.140 --> 00:02:04.656 position:50% align:center size:88% The older last-known-good record is a separate artifact. 00:02:06.800 --> 00:02:10.875 position:50% align:center size:88% Read the confirmation that the report was recorded and downloaded. 00:02:10.950 --> 00:02:13.975 position:50% align:center size:88% Open Documentation and choose Incidents. 00:02:14.100 --> 00:02:17.300 position:50% align:center size:88% Scroll to the report guidance for the written workflow. 00:02:17.375 --> 00:02:20.825 position:50% align:center size:88% Keep the original case date with the exported report. 00:02:20.900 --> 00:02:24.955 position:50% align:center size:88% The report preserves the conclusion and evidence available at that time.