Summary

  • Gravwell's September agent announcement brings investigation and operational workflows into its AI Agent Preview kit, including Community Edition.
  • Current documentation distinguishes conversational approval from unattended execution. A flow's continuation also does not prove that its AI analysis succeeded.

The consequential moment in a security agent's rollout may come before its first investigation: deciding which tools an unattended run is allowed to use. Gravwell's new agents can gather evidence from the deployment they serve. That richer context does not make an interactive demonstration a sufficient test of an automated workflow.

The company described version 5.10 in a 9 September product blog, followed by a 10 September announcement. Its Case Agent helps analysts develop and run queries, while Alert Triage prepares supporting evidence and an initial report. Audit Agent examines deployment health without changing it. These are distinct jobs, not evidence that every agent can remediate an incident.

The AI Agent Preview kit is available across editions, including Community Edition, rather than confined to a separate premium AI tier. Current documentation, labelled 5.10.1, still describes the AI services as beta. Edition availability and proven production performance are different claims.

Approval depends on how the agent runs

The current agent documentation defines an agent through its instructions, permitted tools and, for multistage work, a graph of steps. In a conversation, read-only tools proceed without interruption. A tool that saves a query, creates a macro or changes an alert asks for approval. The user can approve one call or allow that tool for the rest of the conversation.

An agent invoked from a flow cannot stop to ask. Its tool calls execute without an approval prompt. That is not a permission bypass: access remains bounded by the driving user's permissions, and the agent definition can narrow the available tools further. It means that granting a write tool to an unattended agent is a decision made in advance, not one guaranteed to return to an analyst at each use.

The access-control documentation adds an important qualification. Capability Based Access Control, CBAC, uses a deny-all starting policy for ordinary users when enabled, with capabilities and data tags granted to users or groups. Administrators are unrestricted by CBAC. A buyer cannot infer least privilege merely from the presence of a permissions feature; the execution identity and actual configuration matter.

A continuing flow is not necessarily a completed analysis

The Logbot flow-node documentation describes another operational boundary. If its AI API fails, the node puts the error in its output, logs it and lets downstream nodes continue. Its default maximum submitted input is 65,536 bytes; larger input is truncated with a warning. This is an input limit, not proof of a universal limit on everything an agent might retrieve with tools.

Those behaviours support continuity, but continuity alone cannot establish that a usable investigation report exists. A downstream notification or decision must distinguish a valid result from an error and account for incomplete input. That is an implication for workflow design, not a report that Gravwell customers have suffered a particular failure.

The location of tool execution is also distinct from the location of inference. The AI documentation says messages and attached search entries go to the configured endpoint. For Gravwell-hosted services, the company says customer interactions are not used for training, but may remain in memory or logs and may be reviewed by responsible staff. A third-party or self-hosted compatible endpoint is another configuration choice. Working against a customer's deployment does not establish that every AI interaction stays inside it.

Finally, availability of the preview across editions is not unlimited model use. Gravwell-hosted conversation and word limits depend on the licence; third-party service limits depend on that service. No public material examined here establishes a customer's analyst-hours saved, false-positive reduction or total model cost. The commercial opportunity is less repetitive evidence gathering. Realising it still requires decisions about authority, data handling and what counts as a successful output.