Incident investigation is the process of determining what caused a production failure after it has been detected - the work that happens between an alert firing and a remediation being applied.