# Tutorial: Investigate an agentic campaign

> **Status:** Lab-only. **No Phase C hard mode.** Defaults: off / observe.

## Goal

Generate graded agentic telemetry, open Ops Investigate / AgentInvestigatePanel,
and follow a correlated perimeter → internal pivot story without executing
containment.

## Prerequisites

- Sensor with honeytools observe (see [catch-a-hijacked-agent.md](catch-a-hijacked-agent.md))
- Ops GUI with Investigate screen
- Optional EP evaluate notify only
  ([agentic-enforcement-plane.md](../how-to/agentic-enforcement-plane.md))

## Steps

1. Enable `CYBERHALLUCINET_AGENTIC_HONEYTOOLS=observe` on the lab sensor.
2. Trigger at least one exact honeytool touch (and optional canary egress) so
   reason codes appear in telemetry.
3. Open Ops **Investigate** and the agentic panel for the session/campaign.
4. Confirm reason codes / evidence grades are visible as advisory citations : 
   scores must not auto-execute containment.
5. If EP is running, confirm only evaluate/pilot observe traffic, not execute.

## Expected result

SOC-readable advisory trail. No Soft/Hard from this tutorial.

## Safety

- Never publish production decoy names.
- Ops must not hold connector credentials.