> ## Documentation Index
> Fetch the complete documentation index at: https://docs.airmdr.com/llms.txt
> Use this file to discover all available pages before exploring further.
# AI Investigation Depth and Usage Limits
> Understand how AirMDR assigns investigation depth, manages weekly usage, and allows administrators to control alert-type preferences.
SOC leaders, security administrators, security engineers, and analysts.
Learn how investigation levels, weekly limits, accumulated credits, and administrator overrides work.
Manage usage efficiently without leaving alerts uninvestigated.
## Overview
AirMDR uses **Darryl**, its AI investigation engine, to investigate every alert received by the platform.
By default, every alert is analyzed at **Level 3 – Deep Dive**, the most thorough investigation level. When usage exceeds the applicable weekly allowance, Darryl can apply an appropriate investigation depth to each alert type for the remainder of that week.
The recommended depth is based on the alert type’s escalation history in your environment during the previous 30 days. Administrators can review the recommendation and configure a different depth from the **Usage Limits** page.
Every alert is investigated. Usage limits may affect the depth of an investigation, but alerts are never skipped or ignored.
## Investigation Depth Levels
Darryl evaluates how frequently each alert type resulted in a real escalation during the preceding 30 days.
Applied to alert types with no history of escalation in your environment.
**Best suited for:** Consistently low-risk alert types.
Applied to alert types that have escalated occasionally.
**Best suited for:** Alert types requiring additional contextual analysis.
Applied to frequently escalated alert types or alert types without sufficient history for reconsideration.
**Best suited for:** High-risk, business-critical, or newly escalated alert types.
AirMDR validation indicates that Triage and Investigation-level analysis show no significant reduction in detection accuracy compared with Deep Dive.
A lighter investigation level is a calibrated investigation based on the observed risk profile of the alert type. It is not an incomplete or lower-quality check.
## `🤔`How Darryl Determines Investigation Depth?
Darryl reviews the alert type’s escalation history from the previous 30 days.
Darryl assigns Level 1, Level 2, or Level 3 based on the frequency of real escalations.
AirMDR investigates alerts at Level 3 while usage remains within the applicable weekly allowance.
If the applicable usage threshold is exceeded, AirMDR applies the configured depth for each alert type.
At the beginning of the next week, the organization returns to full-depth analysis, subject to the confirmed weekly reset rules.
## Weekly Usage Limit
Each organization has a base weekly usage limit.
Under normal usage conditions, every alert receives **Level 3 – Deep Dive** analysis. The usage limit affects investigation depth only when weekly usage exceeds the organization’s applicable allowance.
Every alert continues to receive Level 3 – Deep Dive analysis.
AirMDR applies the configured investigation depth for each alert type for the remainder of the week.
### Weekly behavior
| Usage condition | AirMDR behavior |
| ---------------------------------- | ----------------------------------------------------------------- |
| Usage remains within the allowance | Every alert receives Level 3 – Deep Dive analysis. |
| Applicable threshold is exceeded | Configured depth is applied by alert type. |
| Adaptive depth is activated | Configured depths remain active for the rest of the week. |
| A new week begins | Full-depth analysis resumes, subject to confirmed reset behavior. |
| Unused credit is available | Credit carries forward and contributes to the accumulated buffer. |
## Usage Threshold
The supplied product information states that adaptive investigation depth begins when weekly usage exceeds **150% of the weekly limit**.
### Example calculation
If the weekly limit is 1,000 usage units:
```text theme={null}
Adaptive-depth threshold = Weekly limit × 150%
Adaptive-depth threshold = 1,000 × 1.5
Adaptive-depth threshold = 1,500 usage units
```
According to this rule, adaptive investigation depth would begin after usage exceeds 1,500 units.
***Product confirmation required***
The source also states that adaptive investigation depth begins only after usage exceeds the accumulated-credit buffer, which can reach five times the base weekly limit.
Confirm how the 150% threshold interacts with accumulated usage credit before publishing this calculation.
## Accumulated Usage Credit
AirMDR does not penalize an organization for a single unusually busy week.
Unused credit from lower-usage weeks carries forward and increases the organization’s available credit. Accumulated credit can grow to a maximum of **five times the base weekly limit**.
### Example
If the base weekly limit is **1,000 usage units**:
```text theme={null}
Maximum available credit = Base weekly limit × 5
Maximum available credit = 1,000 × 5
Maximum available credit = 5,000 usage units
```
When usage exceeds the expanded allowance:
1. Darryl applies the configured investigation depth for each alert type.
2. The configured depth remains active for the rest of that week.
3. Available credit resets to the base weekly limit for subsequent usage periods.
This example explains the five-times accumulated-credit rule only. Confirm the interaction between accumulated credit and the separate 150% threshold before publication.
## Review or Change Investigation Depth
Administrators can review Darryl’s recommendation and configure a different investigation depth for an alert type.
For example, an administrator can retain **Level 3 – Deep Dive** for a business-critical alert type even when Darryl recommends Level 1 or Level 2.
### Prerequisites
You can access the organization [**Usage Limits**](https://app.airmdr.com/admin/org-config) page.
You have reviewed the alert type’s recent escalation history.
You understand the alert type’s operational and business importance.
You have permission to modify investigation-depth preferences.
The source does not specify the exact AirMDR role or permission required to change investigation depth. Confirm the RBAC requirement before publication.
### Configure an investigation depth
1. Login using your organization credentials.
2. In the Left Navigation pane, click on the **ADMIN** drop-down.
3. Select the **Org Config** **→** **Usage Limits** page.
1. Find the alert type whose investigation depth you want to review.
1. Compare Darryl’s recommended depth with the currently configured depth.
2. Review the following information when available:
* Alert type
* Recommended depth
* Configured depth
* Escalation history
* Usage information
1. Select one of the following options:
- **Level 1 – Triage**
* **Level 2 – Investigation**
* **Level 3 – Deep Dive**
2. Save the configuration.
Save or confirm the change if explicit confirmation is required.
3. Verify the updated depth.
Confirm that the selected depth is displayed for the alert type.
### Expected result
The selected investigation depth is saved as a standing preference for the alert type.
The preference remains saved even when Darryl’s recommendation changes as new escalation data becomes available.
### Recommended Depth vs. Configured Depth
| Setting | Description | Automatic update |
| :----------------------- | :---------------------------------------------------------------------------------------------- | :--------------- |
| 🧠 **Recommended depth** | Depth calculated by Darryl using the alert type’s escalation history from the previous 30 days. | Yes |
| ⚙️ **Configured depth** | Depth selected by an authorized administrator for the alert type. | No |
**Example**
Darryl may recommend the following depth for an alert type with no recent escalation history:
```text theme={null}
Level 1 – Triage
```
If the alert type relates to a privileged identity or sensitive system, an administrator can configure:
```text theme={null}
Level 3 – Deep Dive
```
The configured preference remains saved even when Darryl’s recommendation changes.
Confirm whether the configured depth applies only after the weekly threshold is exceeded or immediately after the administrator selects it.
### Manual Reinvestigation
When an analyst manually reinvestigates a case, the reinvestigation always runs at **Level 3 – Deep Dive**.
| Initial investigation | Manual reinvestigation |
| :---------------------- | :--------------------- |
| Level 1 – Triage | Level 3 – Deep Dive |
| Level 2 – Investigation | Level 3 – Deep Dive |
| Level 3 – Deep Dive | Level 3 – Deep Dive |
Initial adaptive investigation depth does not restrict an analyst’s ability to perform a full reinvestigation.
### Nothing Is Left Under-Investigated
Even when an alert type is analyzed at a lighter level, it still receives a complete automated AI investigation.
Alerts are never ignored, skipped, or excluded because of usage.
Analysts can manually reinvestigate a case at Level 3 – Deep Dive.
A lighter level does not mean:
* The alert is ignored.
* The alert is skipped.
* Only a superficial check is performed.
* The alert is excluded from AirMDR investigation.
* An analyst is prevented from performing a deeper review.
### Key Behavior Summary
| Scenario | AirMDR behavior |
| :--------------------------------------------- | :------------------------------------------------------------------ |
| ✅ Usage remains within the allowance | Alerts receive Level 3 – Deep Dive analysis. |
| ⚠️ Applicable allowance is exceeded | Configured depth is applied by alert type. |
| 📅 A new week begins | Full-depth analysis resumes, subject to confirmed reset behavior. |
| ⚙️ An administrator overrides a recommendation | The selected depth is saved as a standing preference. |
| 🧠 Darryl’s recommendation changes | The recommendation updates while the configured preference remains. |
| 🔍 An analyst manually reinvestigates a case | Reinvestigation runs at Level 3 – Deep Dive. |
| 🛡️ A lighter depth is applied | The alert still receives a complete AI investigation. |
| 💳 Unused credit remains | Credit carries forward up to the permitted maximum. |
## Best Practices
Additional recommendations:
* Review alert-type escalation trends regularly.
* Coordinate configuration changes with your SOC team.
* Use manual reinvestigation when closer analysis is required.
* Maintain an audit trail of configuration changes.
* Reassess usage after enabling new integrations or alert sources.
## Frequently Asked Questions
No. Darryl investigates every alert received by AirMDR. Only the depth of the investigation can change for alert types whose escalation history supports a lighter level of analysis.
No significant reduction in detection accuracy was observed in AirMDR’s comparison of Triage and Investigation-level analysis with Deep Dive.
A lighter level is a calibrated AI investigation, not a skipped or incomplete check.
You can select a different investigation depth from the **Usage Limits** page. The configured preference is saved and remains in place until an authorized user changes it.
No. Unused usage credit can accumulate and absorb occasional usage spikes. Accumulated credit can reach up to five times the organization’s base weekly limit.
Weekly full-depth analysis resumes according to the confirmed weekly reset and usage-threshold rules.
Darryl evaluates how often the alert type resulted in a real escalation in your environment during the previous 30 days.
Yes. Darryl recalculates its recommendation as new alert and escalation history becomes available.
No. Your configured preference remains saved even when Darryl’s recommendation changes.
Manual reinvestigation always runs at **Level 3 – Deep Dive**.
No. AirMDR continues to investigate every alert. Only the investigation depth may change for particular alert types.
The configured depth is stored as a standing preference until an authorized user changes it. However, Product or Engineering must confirm whether it is applied only after the usage threshold is exceeded or at all times.
Unused credit can accumulate up to five times the organization’s base weekly limit.
According to the supplied product information, Darryl applies the configured investigation depth for each alert type for the remainder of the week. The available credit then resets to the base weekly limit going forward.
Yes. You can configure Level 3 – Deep Dive for an alert type even if Darryl recommends a lighter investigation depth.
No. The source states that each week starts fresh and the organization returns to full-depth analysis. The exact reset timing and its interaction with saved preferences must be confirmed.