Fun counter-narrative on an AI result we’re sharing next week: You don’t need custom AI models to win investigation capture-the-flag competitions. I’ll be walking through our experience at 39th Chaos Communication Congress next Tuesday on “Breaking (Splunk) BOTS: How We Cheated at Blue Team CTFs with AI Agent Speed Runs”, and we’re bringing the receipts on this one. I believe it should be freely streaming online, and if you’re in Hamburg/Berlin, please say hello. And yes, there will be Louie stickers! Many folks were shocked earlier in the year when we announced the Louie v1 investigation agent hit 75%+ on the Splunk BOTS investigation CTF competition. What the headline misses is the second part: For that run, we intentionally did NOT do custom AI model fine-tuning, automated prompt learning, and other tricks that are often hard to deploy and fail to generalize to the diverse scenarios long-running agents must navigate. Instead, v1 was about how much hardcore context engineering we needed to stuff inside to make an AI that investigates competitively **out-of-the-box**. Yes we work on different kinds of learning and have cool releases ahead, but that’s v2 era: for now, this is how to make out-of-the-box agents that improve whenever OpenAI and friends spend $100M+ on a model jump. The v1 result shows all you need to win, today, is access to widely available models like gpt-4o and a fairly generic investigation prompt of less than 200 lines of markdown instructions. The hard part was building an agent environment that automates investigation-oriented context engineering. This in turn largely comes down to where vibes investigating is similar vs different from today’s best-in-class vibes coding environment. Ex: What you can do out-of-the-box DIY via connecting something like Claude Code to a Splunk MCP, and the gap left to do high-scoring vibes investigations. And of course, how to do that without breaking your monthly token budget. Holiday bonus: We’ll also be announcing something big, so even if you aren’t there, sign up for Louie’s EAP form and you’ll be getting a useful notification on what’s coming next. See everyone in Hamburg! #CCC #chaoscongresscommunications #GenAI #cybersecurity #39thChaosCommunicationCongress #graphistry #louie

Ai investigation power hour's first episode AI Investigation Power Hour with Henning Rauch @cosh23 Principal Program Manager - Azure Data Explorer (Kusto) is going live now on Youtube youtube.com/live/FFJUT_xOkbU… and Linkedin linkedin.com/events/73995282…

Announcing Our First Ever Podcast + Live Webinar AI Investigation Power Hour — Episode 1: Kusto Graph Meets Agentic AI We’re excited to launch our new series: AI Investigation Power Hour. Join hosts @lmeyerov (Founder of Graphistry) and Sindre Breda (Solutions Architect & ex-police officer) as they talk with Henning Rauch @cosh23 , Principal Program Manager at Azur Data Explorer Kusto. They’ll dig into the intersection of Kusto, graphs, and agentic AI — and what this means for the next wave of AI-driven investigations. 🔴 Watch live on LinkedIn and Youtube Click the link in the first comment to book a spot on your calendar. 📅 Live on December 3rd, 2025 ⏰ 7 PM CET / 1 PM EST @Cyb3rWard0g @JohnLaTwC

Big News: Microsoft published an official integration between Graphistry and Azure Data Explorer. In partnership with Microsoft, Graphistry adds server-side GPU visual AI to KQL graph semantics, enabling fast, in-tenant, iterative graph visualization and intelligent automation. This brings team visual and automated investigations of connected data that are much faster, larger, and smarter than previously possible while keeping processing and governance inside their own Azure subscription. learn.microsoft.com/en-us/ku… A big thank you to @cosh23 and @JohnLaTwC for their support #AzureDataExplorer #Kusto #Graphistry #DataVisualization #Graph #GPU #Eventhouse

As part of our mission to bring generative AI to data-intensive investigation & automation, we’re launching a new two-day online masterclass on AI agents & RAG for security teams. Enrollment is now open and limited. Why now: Leaders are under pressure to cut down backlogs and response times without adding headcount. Analysts and engineers are still stuck copy-pasting into copilots. Everyone is evaluating generative AI for investigation and automation – but the rise of agentic AI resets both how and where to apply it. This masterclass, taught by award-winning security AI experts, moves you from copilots to durable RAG and production agents that investigate and act with oversight. Why us: We’re the team behind the first agentic AI speed run of the @splunk Boss of the SOC investigation CTF, the U.S. Cyber Command AI alert challenge win, and helped run Black Hat’s most-attended AI security training. What: Hands-on AI cyber range with @splunk, #kusto, and @databricks, instructor-led online masterclass with labs, AI cyber range, peer discussions, templates, vendor-neutral OSS paths – plus how the same workflows run in enterprise AI-native tools like Louie.ai. What you’ll leave with ✔️Leaders: Forward-looking AI plan, high-ROI workflow picks, governance paths ✔️Engineers: Scalable patterns for tool-calling, RAG, and evals balancing speed, quality, and cost ✔️Analysts: Quickly build self-planning AI agents that investigate, triage, hunt, and automate Details: Nov 6–7, 2025 • Online • 16 CPE • 45 Seats • Recordings/materials included Next step Full agenda + reserve your seat: louie.ai/events/ai-agent-rag… Visit @Cyb3rWard0g if you are interested in learning about cybersecurity and AI. For more on kusto ADX check out @cosh23 @JohnLaTwC #AISOC #AIAgents #RAG #GraphRAG