---
updatedAt: 2026-02-25T19:02:36.000Z
agentTools:
projectIndex: https://docs.spycloud.com/public-sc/llms.txt
---
# Saving Investigations
WITHIN SPYCLOUD INVESTIGATIONS MODULE
**πVIEW YOUR SAVED INVESTIGATIONS IN ONE TABLE**
# OVERVIEW
SpyCloud Investigations **automatically saves every investigation you start**. Each investigation is auto-created upon your first search and persists across sessions. Searches, pivots, record-level edits, and supported graph settings are preserved so you can resume work exactly where you left off. **Note**: no manual save action required.
* Every investigation is automatically created on first search
* Work is continuously autosaved
* Investigations persist across your sessions
* A new **My Investigations** view centralizes your saved work, directly within the module
* Controls for inline rename, delete, and starring your favorites
Saving requires either a CORE or PRO Investigations module license.
***
# π§ How Saving Works
## Automatic Creation
When you run a **Standard** or **IDLink** investigation:
* A new investigation is created automatically
* A name is auto-generated based on the starting asset
* The investigation appears in your **My Investigations** home view
***
## πΎ Autosave Model
Investigations are continuously saved as you work. The following elements are persisted:
### π Searches
* Standard searches
* IDLink searches & Depth setting
* Filters applied to searches
### π Investigation Activity
* Pivots
* Record removals
* Search removals
* Timeline history
### π Graph Settings (Persisted)
| Setting | Persisted |
| -------------------------- | --------- |
| Layout selection | β
|
| Orientation | β
|
| Legend display | β
|
| Per-item legend visibility | β
|
| X/Y coordinates | β
|
| Layout changes | β
|
# π Investigations Home
Select **Investigations** from the left-hand navigation to access your saved investigations. The **My Investigations** table displays:
| Column | Description |
| -------------- | ------------------------ |
| Name | Investigation name |
| Starting Asset | Initial asset used |
| # of Records | Current record count |
| Date Created | Creation timestamp |
| Last Updated | Most recent modification |
The investigation count (e.g., *My Investigations (30)*) reflects the total number of saved investigations for the current user. Saved investigations are:
* User-specific
* Not visible to other users
***
**πRENAME YOUR INVESTIGATIONS DIRECTLY IN THE HEADER**
# βοΈ Renaming an Investigation
You can rename an investigation in two locations:
### From the Investigation Header
* Open the dropdown next to the investigation name and select **Rename**
* Or start typing directly in-line
### From the Home Table
* Open the row options menu
* Select **Rename**
Changes apply immediately and are auto-saved.
***
**πSTART YOUR INVESTIGATIONS AS FAVORITES**
# β Favorites
You can mark investigations as Favorites from the home table. Favorites:
* Are user-specific
* Can be filtered using the Favorites filter
* Do not affect permissions or sharing
* Can be removed
***
# π Deleting an Investigation
You can delete investigations directly from the home table.
Deleting an investigation:
* Displays a confirmation prompt
* Permanently removes the saved investigation
***
# π Resuming Work
To resume an investigation:
1. Select **Investigations** from the left navigation.
2. Open the **My Investigations** view.
3. Click the investigation name.
The investigation opens in its last-used condition, with supported graph settings and activity restored.
***
# π― User Benefits
Saved Investigations allow analysts to:
* Maintain long-running identity investigations
* Preserve pivots and removals
* Avoid repeating searches
* Organize work for future reference
* Resume complex cases without losing context
Investigations becomes a structured, persistent workspace for cybercrime and identity threat investigations.
***