Skip to main content

ThirdLaw Investigate

ThirdLaw Investigate is the flexible query and exploration interface of the ThirdLaw platform, purpose-built to help IT, Security, and Compliance teams understand what happened, when, and why in LLM-powered applications. Just as Splunk helped teams unravel complex logs to trace root causes in distributed systems, Investigate enables teams to trace risks, failures, or anomalies across user sessions, agents, apps, and LLM interactions.

It is the final stage of the ThirdLaw loop, sitting after Collect (data acquisition), Evaluate (policy analysis), and Intervene (response). Investigate provides structured and exploratory tools for retrospective analysis and deep forensic audits.

Key Capabilities​

ThirdLaw Investigate enables deep exploration of conversation history, providing tools for auditing, reporting, and understanding patterns of usage and potential misuse. It supports compliance documentation and continuous improvement of your AI governance approach.

  • Flexible Search & Filtering: Schema-on-read search over normalized and raw data from Collect.
  • Contextual Drilldown: Navigate from summaries to full detail—trace prompts, responses, agent traces, and violations across time.
  • Correlation & Causality Tools: Link events, sessions, and policy violations to reveal root causes and systemic patterns.
  • Reporting & Visualization: Create shareable, scheduled, or exportable reports across use cases like compliance, anomaly analysis, and user behavior.

Investigate closes the loop by enabling retrospective investigation and root cause analysis, using the same data models and metadata that power Evaluate and Intervene.

Why ThirdLaw Investigate?​

  • Tailored for LLM Risk and Compliance: Not a generic log search tool, but built for session-based, multimodal, AI-oriented analysis.
  • Deeply Linked with Collect + Evaluate: Supports rich contextual links—every search knows how to find related prompts, violations, actions, and outcomes.
  • Usable by Non-Engineers: UI-driven query interface with NLU support for flexible filtering.
  • Fast and Scalable: Built on a search layer optimized for high cardinality and unstructured content.
  • Actionable: Investigations can feed back into Law authoring, policy tuning, or trigger retroactive enforcement.