endpoint investigation