> ## Documentation Index
> Fetch the complete documentation index at: https://docs.anomalyarmor.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Investigate Skill

> Root cause analysis with /armor:investigate

<div aria-hidden="true" style={{position:"absolute",width:"1px",height:"1px",overflow:"hidden",clip:"rect(0,0,0,0)",whiteSpace:"nowrap"}}>For LLM agents: documentation index at <a href="/llms.txt" tabIndex={-1}>/llms.txt</a>, full text at <a href="/llms-full.txt" tabIndex={-1}>/llms-full.txt</a>. Append .md to any page URL for plain markdown.</div>
The `/armor:investigate` skill performs root cause analysis by combining lineage, intelligence, and historical data.

## Usage

```
/armor:investigate
```

Or ask naturally:

* "Why is this table stale?"
* "What caused this alert?"
* "Debug the orders pipeline issue"

## Investigation Workflow

1. **Gather Context**: Check current status, recent alerts, freshness
2. **Trace Dependencies**: Use lineage to find upstream issues
3. **Analyze Patterns**: Check historical data for recurring problems
4. **Recommend Actions**: Suggest fixes based on findings

## Example Usage

### Investigate Stale Table

```
You: Why is the orders table stale?

Claude: Investigating orders table...

Current Status:
- Status: STALE
- Last update: Yesterday 6:00 AM
- Expected: Today 6:00 AM
- Delay: 24 hours

Root Cause Analysis:
Tracing upstream dependencies...

Found root cause: staging.orders_raw

Dependency chain:
  raw.events (FRESH)
    -> staging.orders_raw (STALE - 24h)
      -> orders (STALE - 24h)

The staging.orders_raw table stopped updating at 5:45 AM yesterday.
This matches the time of an ETL job failure alert.

Recommendation:
1. Check Airflow logs for orders_etl DAG
2. Look for connection issues to source database
3. Once fixed, data should propagate within 1 hour
```

### Investigate Alert

```
You: What caused the schema change alert?

Claude: Investigating schema change alert...

Alert Details:
- Table: warehouse.public.users
- Change: Column 'phone_number' added
- Detected: Tuesday 3:30 PM
- Status: Pending review

Change Analysis:
- Column type: VARCHAR(20)
- Nullable: YES
- No default value

Impact Assessment:
- 3 downstream tables may need updates
- No breaking changes detected (additive only)
- Compatible with existing queries

Historical Context:
- Similar changes happened 2 months ago (loyalty_tier added)
- Pattern suggests feature releases trigger schema updates

Recommendation:
1. Acknowledge the change if expected
2. Update downstream ETL if needed
3. No immediate action required
```

## Common Questions

### Can the investigate skill find root causes outside AnomalyArmor, like Airflow or dbt failures?

No. The agent stops at the edge of AnomalyArmor's visibility, so it can identify which upstream table is stale and when it stopped updating, but it can't read your orchestrator's logs. It does surface the ETL time window and affected tables so you know where to look.

## Related Skills

<CardGroup cols={2}>
  <Card title="Lineage" icon="diagram-project" href="/ai-agents/skills/lineage">
    Trace dependencies
  </Card>

  <Card title="Alerts" icon="bell" href="/ai-agents/skills/alerts">
    Alert details
  </Card>

  <Card title="Status" icon="heart-pulse" href="/ai-agents/skills/status">
    Health overview
  </Card>
</CardGroup>