Create your first investigation

Begin a structured investigation without skipping essential details.

This guide explains how to begin a structured investigation without skipping essential details. It outlines the preparation, practical steps and checks that help keep your work accurate and traceable within ICAM Plus.

The exact controls available can depend on your active Personal or Organization workspace, subscription, investigation status and assigned permissions. Follow the current application labels where they differ from the descriptions below.

Before you begin

Sign in using an authorized ICAM Plus account. Confirm the correct workspace and, where applicable, the investigation and organizational role. Keep the relevant incident facts or account details available without exposing passwords, tokens or unnecessary sensitive information.

Step-by-step instructions

Step 1 — Choose the correct workspace.

Confirm that the selected context is the one in which the record should be owned and accessed. Personal and Organization workspaces are separate; do not assume that switching workspaces moves existing investigations.

Step 2 — Open Investigations.

Complete this action using the controls available to your role and current application version. Check the resulting record before continuing, and document anything incomplete or inconsistent for follow-up.

Step 3 — Select the new investigation action.

Complete this action using the controls available to your role and current application version. Check the resulting record before continuing, and document anything incomplete or inconsistent for follow-up.

Step 4 — Choose an available approved template.

Check both the investigation stage and the assigned role. Review and approval actions are permission-dependent, and an unavailable action should be treated as a workflow or assignment issue rather than bypassed.

Step 5 — Record an unambiguous title, event date and basic description.

Use the best-supported date and time available; clearly distinguish verified information from estimates or unconfirmed recollections. Revisit the entry if additional evidence changes the sequence.

Step 6 — Save the draft and confirm it appears in the investigation list.

After the action, inspect the resulting record or confirmation rather than assuming a tap or click was successful. If it did not persist, avoid duplicate submissions and record the observed failure.

Confirm the expected outcome in the application before leaving the screen. Keep a record of any missing information or blocked action rather than treating the task as completed.

Important considerations

Template visibility depends on workspace and subscription.

Avoid: Using an unavailable template.

Avoid: omitting the event date.

Avoid: accidentally creating a duplicate.

Troubleshooting

The option is missing or unavailable

Verify your workspace, role, current investigation stage and subscription availability. A hidden or disabled control is not permission to bypass the intended workflow.

The expected change is not visible

Check the relevant record and selected filters. Confirm whether the operation was saved or submitted. Avoid repeating changes that may create a duplicate; if the problem persists, document what you can observe.

You still cannot complete the task

Use the official Contact Support route. Include the app platform and version, affected workflow, expected result, actual result and a sanitized error message when available. Never include passwords, API tokens or unnecessary personal data.

Expected outcome

A saved draft appears under the intended workspace.

Related guides

• G03 — Choose an investigation template

• Related — Set up an investigation team

Further assistance

If the task remains blocked, navigate to Contact Support through the approved ICAM Plus help route. Describe what you attempted, what happened and which investigation or account area is affected, using only the minimum information needed.

GETTING STARTED  /  G02