Use when the user provides a transaction hash (0x...) with a chain name, asks to investigate an on-chain incident or exploit, or points to an incident brief file.