# Investigate Stage — Elaboration

## Criteria Guidance

### Good criteria — concrete and verifiable

- "Timeline reconstructs the incident from first anomaly to detection with timestamps from at least 2 independent sources"
- "Root cause hypothesis is supported by log evidence with specific entries cited"
- "Contributing factors are distinguished from the root cause with evidence for each"

### Bad criteria — vague (no clear check)

- "Root cause is found"
- "Logs are analyzed"
- "Investigation is thorough"

