# Garudon > Give every investigation a clear question and a recorded history. Structure security and incident investigations around explicit cases, scope, transaction and account references, revisions, and recorded outcomes. 1. [Platform](https://trilocore.com/platform/) 2. Garudon Give every investigation a clear question and a recorded history. Garudon organizes security and incident investigations into structured cases with explicit scope, transaction and account references, revision history, and recorded outcomes. [Book a demo](https://trilocore.com/demo) [See Radar monitoring](https://trilocore.com/platform/radar) At a glance - Status: Available - Access: Guided walkthrough and deployment — [book a demo](https://trilocore.com/demo) - Case records: Investigation question, scope, references, revisions, outcomes - Current scope: Case ledger available; automated evidence import and exports not available The problem ## Incident investigations lose their reasoning when they happen in chat rooms When an alert fires or an unusual transaction appears, responders paste hashes, addresses, and hypotheses into an ephemeral channel. Hours or weeks later, it is difficult to reconstruct what question was actually asked, which transactions and accounts were examined, how the scope changed, or why the case was closed. 01 ### Frame the question Open a case around a stated investigation question, target network, affected protocol or asset, and the block or time window under review. 02 ### Attach references Link transaction hashes, account and contract addresses, [Radar](https://trilocore.com/platform/radar) alerts, or [Protect](https://trilocore.com/platform/protect) assessment references to the case. 03 ### Track revisions Every update to the question, scope, or attached references creates a numbered revision so the team can see how the investigation evolved. 04 ### Record the outcome Close the case with an explicit disposition — confirmed incident, authorized operation, false positive, or inconclusive — and a written rationale. Capabilities ## What is available today and what is not yet available Garudon provides a structured case and revision ledger today. Deeper automation and export capabilities remain planned and are marked clearly below. ### Cases and investigation scope Create a structured investigation case with a title, primary investigation question, priority, status, and bounded chain, protocol, and block-range scope. Available today. ### Transaction and account references Attach typed seed references to a case — including on-chain transactions, accounts, contracts, [Radar](https://trilocore.com/platform/radar) alerts, and [Protect](https://trilocore.com/platform/protect) assessments — with responder notes explaining why each item matters. Available today. ### Revision history Every change to the investigation question, scope, references, or status is recorded as a numbered revision with author and timestamp so the progression of an investigation is never overwritten. Available today. ### Recorded outcomes Record a structured outcome and disposition when resolving or pausing a case, capturing the conclusion and supporting rationale for post-incident review or compliance records. Available today. ### Automated evidence import and causal graphs Automatic ingestion of on-chain traces into a case and structured causal investigation graphs are planned capabilities and are **not available** today. ### Direct replay integration and bundle exports One-click launch into an [Auditing IDE](https://trilocore.com/platform/auditing-ide) replay session from a case and portable evidence bundle exports are **not available** today. Example outcome ## An auditable record of what was investigated and why When a monitoring alert flags an unexpected implementation slot change on a treasury proxy, the response team opens a Garudon case. Every responder sees the same question, the same referenced transactions and accounts, the revision history as scope narrows, and the final recorded disposition. 1. Revision 1 · Case opened Radar alert alrt_01ja3… attached 2. Revision 2 · Scope bounded Ethereum blocks 21,018,400..21,018,460 3. Revision 3 · References added tx 0x88d1…c402 & timelock 0x7f02…00c1 4. Revision 4 · Outcome recorded Resolved: authorized scheduled upgrade Illustrative Garudon investigation case showing an investigation question on an EIP-1967 implementation change, 3 attached references, revision 4, and a resolved disposition. Who it is for ## Designed for teams that investigate alerts, incidents, and high-risk activity ### Protocol security teams Turn [Radar](https://trilocore.com/platform/radar) contract-change alerts into scoped cases, verify whether an admin or implementation change matched an approved proposal, and keep a permanent record of the decision. ### Exchanges and listing teams When a listed token or bridge contract exhibits an unexpected upgrade or privileged call, track the investigation scope, relevant transactions, and disposition for listing and risk committees. ### Auditors and incident responders Maintain a clean revision history of hypotheses, examined transactions, and conclusions during a live inquiry or post-mortem review. Coverage and limits ## What Garudon covers today and what remains planned Garudon focuses on structured case management, scope, references, revisions, and outcomes. - Case lifecycle: Available. Create, scope, update, and resolve investigation cases with explicit questions and dispositions - Typed references: Available. Reference transactions, accounts, contracts, Radar alerts, and Protect assessments within a case - Revision tracking: Available. Append-only revision history across case edits, reference additions, and outcome updates - Automated evidence import: Not available. Traces and external evidence are referenced manually today - Causal investigation & replay link: Not available. Causal claim graphs and direct replay handoff into [Auditing IDE](https://trilocore.com/platform/auditing-ide) are not available - Evidence bundle exports: Not available ## Walk through Garudon with your security team. Book a demo to see how Garudon pairs with Radar monitoring and Protect assessments for structured investigation workflows. [Book a demo](https://trilocore.com/demo) [Explore the platform](https://trilocore.com/platform/) --- [Canonical HTML version](https://trilocore.com/platform/garudon)