Gravwell adds five AI agents that gather their own investigation context

Gravwell Inc. released Gravwell 5.10, an update that embeds five AI agents inside a customer's deployment, with each agent gathering its own investigation context via a Model Context Protocol server rather than relying on preassembled context, alert bodies or case files. Three agents work alongside analysts — the Case Agent, Alert Triage Agent and Daily Summary Agent — while the Admin Agent and Audit Agent serve administrators, and all five ship in the AI Agent Preview kit across Gravwell editions including the free Community Edition. "Autonomy without context or boundaries can create more problems than it solves," said co-founder and Chief Executive Corey Thuen, who said agents operating inside defined tools and permissions give security teams a controlled path toward more autonomy.

Gravwell adds five AI agents that gather their own investigation context Security data platform company Gravwell Inc. https://www.gravwell.io/ today released Gravwell 5.10, an update that puts five artificial intelligence agents inside a customer’s deployment. The agents collect the context an investigation needs on their own. A Model Context Protocol server gets them there. An agent can pull live telemetry, detections, system state and saved searches, then call the platform’s own tools to run queries and collect evidence until it has something worth an analyst’s time. Gravwell said none of that depends on preassembled context, the alert body or case file that AI features in security tooling typically work from. Three of the five work alongside analysts. The Case Agent stays with an investigation from the start, writing and validating Gravwell queries, running them and suggesting the next pivot. It remains read-only unless told to save something. The Alert Triage Agent sits between a detection and the analyst who receives it, running supporting queries and assembling an opening report so the alert does not land bare. Overnight work goes to the Daily Summary Agent, which reviews the previous day’s telemetry and hands over queries analysts can run against what it found. The remaining two answer to administrators. The Admin Agent fields configuration questions about a deployment, covering ingesters, access controls, storage and replication. The Audit Agent runs a read-only hygiene pass across automations, alerts, query content and data flows. Stalled searches, duplicate extractors and dead data feeds go into one prioritized report. All five arrive in what Gravwell calls the AI Agent Preview kit. Each agent specification defines which tools and which portions of the MCP environment that agent can reach, which actions it can take and which procedure it follows. The update also draws agent runs on-screen, so a team can see which tools were called, what was read and how the agent got to its conclusion. “Autonomy without context or boundaries can create more problems than it solves,” said co-founder and Chief Executive Corey Thuen. Agents that draw on a customer’s real environment while operating inside defined tools and permissions give security teams a controlled path toward more autonomy, he said, without handing AI unrestricted access to security operations. The preview kit ships across Gravwell editions, including the free Community Edition, rather than sitting behind a premium AI tier. Founded in 2017, Gravwell sells its platform as a replacement for legacy security information and event management systems, ingesting data in full fidelity and applying structure only at query time. Two Bear Capital led a $15.4 million Series A round for the Minneapolis-based company last October https://www.gravwell.io/newsroom/gravwell-announces-series-a-funding . Gula Tech Adventures Inc., Next Frontier Capital and Kickstart also took part. Agentic tooling has become a common thread across security operations vendors this year. Blumira Inc. opened a pilot of its own agentic investigation engine, Kindling, in May https://siliconangle.com/2026/05/13/blumira-launches-kindling-pilot-agentic-siem-investigation-engine-cuts-alert-volume-50x/ . Image: SiliconANGLE/GPT Image 2.5 A message from John Furrier, co-founder of SiliconANGLE: Support our mission to keep content open and free by engaging with theCUBE community. Join theCUBE’s Alumni Trust Network , where technology leaders connect, share intelligence and create opportunities. - 15M+ viewers of theCUBE videos , powering conversations across AI, cloud, cybersecurity and more - 11.4k+ theCUBE alumni — Connect with more than 11,400 tech and business leaders shaping the future through a unique trusted-based network Are you an AWS customer? Support SiliconANGLE financially by buying your AWS services from our Marketplace portal page and links: https://siliconangle.com/aws-marketplace/ https://siliconangle.com/aws-marketplace/ About SiliconANGLE Media SiliconANGLE https://cts.businesswire.com/ct/CT?id=smartlink&url=https%3A%2F%2Fsiliconangle.com%2F&esheet=54119777&newsitemid=20240910506833&lan=en-US&anchor=SiliconANGLE&index=9&md5=646b1b564e2259100a2b8638aab0a552 , theCUBE Network https://cts.businesswire.com/ct/CT?id=smartlink&url=https%3A%2F%2Fwww.thecube.net%2F&esheet=54119777&newsitemid=20240910506833&lan=en-US&anchor=theCUBE+Network&index=10&md5=7de2a85f95ab4a4a495cede20b8cb1da , theCUBE Research https://cts.businesswire.com/ct/CT?id=smartlink&url=https%3A%2F%2Fthecuberesearch.com%2F&esheet=54119777&newsitemid=20240910506833&lan=en-US&anchor=theCUBE+Research&index=11&md5=7bb33676722925eb57d588ec343e4f6f , CUBE365 https://cts.businesswire.com/ct/CT?id=smartlink&url=https%3A%2F%2Fwww.cube365.net%2F&esheet=54119777&newsitemid=20240910506833&lan=en-US&anchor=CUBE365&index=12&md5=d310fb35919714e66ad8d42c9c0c1bc6 , theCUBE AI https://cts.businesswire.com/ct/CT?id=smartlink&url=https%3A%2F%2Fwww.thecubeai.com%2F&esheet=54119777&newsitemid=20240910506833&lan=en-US&anchor=theCUBE+AI&index=13&md5=b8b98472f8071b23ebb10ab9a8dd0683 and theCUBE SuperStudios — with flagship locations in Silicon Valley and the New York Stock Exchange — SiliconANGLE Media operates at the intersection of media, technology and AI. Founded by tech visionaries John Furrier and Dave Vellante, SiliconANGLE Media has built a dynamic ecosystem of industry-leading digital media brands that reach 15+ million elite tech professionals. Our new proprietary theCUBE AI Video Cloud is breaking ground in audience interaction, leveraging theCUBEai.com neural network to help technology companies make data-driven decisions and stay at the forefront of industry conversations.