Gravwell 5.10 Introduces Environment-aware AI Agents for Security Operations

New set of specialized agents investigate alerts, support threat hunting, and help maintain platform health

MINNEAPOLIS, Sept. 10, 2026 /PRNewswire/ -- Gravwell, the full-stack data analytics and security platform, today announced Gravwell 5.10, introducing environment-aware AI agents that perform multi-step security and operational workflows directly within a customer's deployment.

Rather than reasoning primarily from limited, preassembled context such as alerts, cases, or preconfigured integrations, Gravwell agents can gather the context they need directly from the environment, including live telemetry, searches, detections, system state, flows, and playbooks. Using that context, agents can call the appropriate Gravwell tools to investigate activity, gather supporting evidence, troubleshoot issues, and surface findings that require human attention.

Agentic Security Built for Security and IT Operations

Gravwell 5.10 introduces a set of specialized agents designed to support different areas of security analysis and platform operations. They include:

• Case Agent: Acts as an interactive investigation partner for analysts and threat hunters. It can write and validate Gravwell queries, run them, interpret the results and recommend the next investigative pivot while maintaining context throughout the investigation. The agent is read-only by default and saves queries only when explicitly instructed.
• Alert Triage Agent: Operates between the detection and the analyst, reviewing alerts, running supporting queries, collecting relevant context and preparing an initial investigation report. Analysts receive supporting evidence and a clearer starting point rather than an isolated alert.
• Admin Agent: Answers questions based on the configuration of an organization's Gravwell deployment. It can help administrators understand ingesters, access controls, storage, replication, preprocessors, resources, secrets, and overall platform health.
• Daily Summary Agent: Runs nightly to review the previous day's telemetry, identify activity that may warrant attention, and suggest areas for further investigation. It also provides queries analysts can use to explore its findings.
• Audit Agent: Performs a read-only health and hygiene assessment across automations, alerts, query content, infrastructure, and data flows. It identifies issues such as stalled searches, unused alerts, duplicate extractors, missing ingesters, dead data feeds, and storage problems, then consolidates them into a prioritized report.

Together, the agents handle repetitive evidence gathering, initial analysis and platform checks, giving analysts and administrators a more informed starting point and allowing them to focus on work that requires human judgment.

Controlled and Auditable AI Workflows

The agents are delivered through the AI Agent Preview kit, which provides prebuilt agents with defined tools, permissions, and workflows. Each agent specification defines which tools and portions of the MCP environment it can access, which actions it can perform, and which procedures it follows.

Gravwell 5.10 also features an in-product visualization of agent workflows. Users can see how an agent gathers information, applies its instructions, interacts with available tools, and progresses toward an outcome. This gives teams visibility into what an agent accessed, what steps it took and how it reached its conclusions.

"Autonomy without context or boundaries can create more problems than it solves," said Corey Thuen, CEO and co-founder of Gravwell. "Gravwell agents can gather the context they need from the customer's actual environment while operating within defined tools, permissions and procedures. That gives security teams a controlled path toward greater autonomy without giving AI unrestricted access to security operations."

The AI Agent Preview kit is available across Gravwell editions, including Community Edition, rather than being restricted to a separate premium AI tier. Read more about Gravwell 5.10 in the blog post here.

About Gravwell

Gravwell is a security data platform built from scratch to replace legacy SIEMs. Designed by engineers with national laboratory backgrounds, Gravwell ingests and stores all data types in full fidelity without upfront parsing, delivering complete visibility at predictable cost. With schema-on-read architecture, flexible deployment options, and dedicated Mission Support, Gravwell enables organizations to scale security operations without ingest-based cost penalties or operational burden. Take a deeper look at platform features, and for more information, visit: www.gravwell.io/ce.

SOURCE Gravwell Inc.