investigation export.

README.md

@@ -115,6 +115,19 @@ Use the dashboard incident actions to acknowledge, resolve, or reopen an inciden
 and attach a note. The state is keyed to a stable incident fingerprint so it can
 survive monitor refreshes even when the current detection window changes.
 
+Export the current investigation view when you need to share or archive an
+incident outside the dashboard:
+
+```bash
+signalscope export-investigation --format markdown --output exports/investigation.md
+signalscope export-investigation --incident-id <incident-id> --format json
+```
+
+The report is built from `state/fgai-status.json` by default and includes
+summary counters, stream coverage, incident state, analyst notes, evidence,
+timeline rows, and Graylog query details. The dashboard exposes the same data at
+`/api/export/incidents?format=markdown` or `format=json`.
+
 With a stream profile in place, SignalScope also builds independent burst
 baselines for authentication failures, DNS queries, and deny/block actions when
 those events are present. These are evaluated per configured entity, so a Windows