---
updatedAt: 2026-04-14T20:06:26.000Z
agentTools:
projectIndex: https://docs.censys.com/llms.txt
---
# Investigation Manager
Use the Investigation Manager in the Platform console to build node-based trees to discover, visualize, and understand connections between assets in the Censys datasets.
Your investigations can start with assets or queries. CensEye automated pivoting functionality is built into the manager to help you quickly find valuable insights.
The Investigation Manager is available to users with access to the Adversary Investigation module. At this time, users can only see, edit, and delete their own investigations.
## Video overview
## Create investigation
To create a new investigation and add its first node, use the following process.
1. In the Platform web UI, open the left-side navigation menu and select **Investigate**.
2. On the Investigation Manager page, click **Create investigation**.
3. Click the **+ Add Node** button and select **Asset Node** or **Query Node**.
4. Enter the required information for your asset or query node, then click **Add Node**.
To delete a node, click the three-dot icon on the right side of the node card and then click **Delete Node**.
## Create investigation from an asset or a collection page
To create a new investigation directly from an asset or a collection page, click the **Start Investigation** button in the top-right corner of the page.
## Investigation composition
Investigations are composed of asset and query nodes and the connections between them.
### Asset nodes
Assets nodes can be hosts (identified by an IP address), web properties (identified by an IP/hostname and port combination using the format `hostname:port`), or certificates (identified by a SHA-256 fingerprint) that are present in the Platform datasets.
#### View asset details
To see the full details for an asset, click the three-dot icon on the right side of the node card and then click **View details**.
#### Run CensEye on an asset
1. Click the lightbulb icon in the node card. The top results discovered via CensEye will display within the card.
2. Click on any result to create a connected query node for field-value pairs discovered by CensEye.
You can re-run CensEye on an asset by clicking the refresh icon in the node card.
### Query nodes
Query nodes are composed of a valid Censys Query Language (CenQL) query. You can manually input query nodes or they can be discovered via CensEye pivots.
#### Run query
1. Click the magnifying glass icon in the node card. The first 100 results will be displayed.
2. Click on any result to create a connected asset node and continue your investigation.
* To see the complete list of results for your search, click the three-dot icon on the right side of the node card and then click **See Full Search Results**.
## Rename or delete investigation
To rename or delete an investigation, open the **Actions** menu above the investigation interface, then click **Rename Investigation** or **Delete Investigation**.
## View investigations
On the Investigate page, in the top left corner of the page, click the arrow next to your current investigation's name to see all of your saved investigations.
## Download investigation
You can download an investigation in JSON format to parse out specific nodes of interest or import your investigation into a React Flow interface.
To download your investigation in JSON format:
1. Click the **Actions** menu.
2. Select the **Download JSON** option.