Cross-App Investigation
Tracing one topic across systems via the Enterprise Graph
You'll be able to
- Follow a single topic across multiple connected apps in one investigation
- Use datasource scoping to read each system's view of the same entity
Read first
Day 5 Lab
- Choose one entity to investigate — a project, an incident, or a customer.
- Run the topic query unscoped and note which apps surfaced hits.
- Scope to each app in turn (
app:gdrive,app:slack,app:jira) and read that system's slice. - Assemble the slices into a timeline: decision → discussion → execution.
- Note any gap where one system has the story and another is silent — that gap is a finding.
Working Example: One Topic, Several Systems
The graph relates an entity to signals scattered across apps. Scope to each app to read its view, then stitch the views into one narrative. Verified against enterprise_graph.
Entity: incident "INC-204"
app:gdrive incident INC-204 → the postmortem doc (the decisions)
app:slack incident INC-204 → the #incident channel (the live debate)
app:jira incident INC-204 → the remediation tickets (the follow-up work)
Stitch them in time order:
Slack (what happened, live) → Jira (what we committed to fix)
→ Drive (what we concluded, written up)
A silent system is itself a signal: no tickets means no follow-up was filed.Check for understanding
Pick one topic and name the order of apps you'd check to reconstruct its full story, and why that order.
Check yourself
1. When stacking operators on a 500-result query, how do you know which constraint did the real work?
2. You're exploring an unfamiliar result set and don't yet know which apps have hits. What's the better tool?
3. A trusted document ranks at #8. What's the honest way to investigate the ranking?
4. What three things must a written search recipe include so a teammate reproduces your exact result set?
5. Which question best justifies Glean's multi-step thinking mode over a quick answer?
In 10 seconds
“A real story rarely lives in one app. Anchor on the entity in the graph, then walk it app by app — the decision in docs, the debate in Slack, the work in tickets.”
Assistant Thinking Mode