Two of the most important primitives in AI investigations are agentic timelining and long-term memory. When we announced that the Louie.ai AI research team became the first to not just beat CTFs like Splunk Boss of the SOC (2024/2025), but to now also fully clear them (2026), our superweapon was conceptually simple: effective agentic timelining.
Capping off our week of Black Hat / AI4 announcements, we’re launching agentic timelining and long-term memory in Louie.ai. Timelining and memory replaces scrolling through logs with high-leverage guidance, quality enforcement, and automatically improving your organization every day. They are further supercharging Louie.ai vibes investigating and agentic investigation automation so you can investigate smarter, faster, and with 3X fewer tokens burned.
What is agentic timelining?
An easy way to think about timelining is that agents need to be able to make maps for themselves. More formally, timelines are first-class agentically-generated retrieval indexes over large amounts of temporal data.
When agents are equipped with good maps, they can bypass discovery steps and run straight to the answer. Native agentic timelining support is a great example of what separates investigation agents from regular coding agents.
The video shows:
- Telling Louie to make a timeline, meaning Louie agents iteratively investigate the connected databases and APIs
- Immediately start viewing and using the timeline even as the agents keep growing it live
- Using the timeline – and any previous ones Louie correlates – then feed into clear textual views, interactive visualizations, and linked evidence
When we measure the impact of great timelining on agentic investigation benchmarks like the CyBT-CTF and Splunk BOTSv3 investigation CTFs, not only do task success rates leap from 70%+ to 96%+, agents now run 3x faster and for a 3x smaller token budget. Top organizations like Google incident response made timelining a tool-supported process for manual investigations even before agentic AI, and all teams have handbooks in some form. We are industrializing the timelining and memory process, and moving them more centrally: timelines and memory are becoming a structuring layer. The result is you can now better turn AI-powered investigations into reliable data flywheels that grow both your incident knowledge base and your skill base.
We have begun using timelines to enable various workflows. Notable examples already include clearer visual summaries of scenarios, more quickly answering follow-on questions, generating high-visibility Graphistry GPU graph visualizations, and better recommending next steps. Every time, we find these kinds of workflows run faster, at higher-quality, more reliably, and at lower cost by being able to use timelines as maps. Also a relief, timelining also gives a stronger evidence-linking layer for insights and cases.
Long-term memory is almost the flip of timelining. Timelining captures short-term memories around an incident: Long-term memory gives automatic and controllable ways for Louie agents to steadily learn broader data and workflows. We will be writing more about both in the coming months.
| Situation | Louie.ai capability matchup |
| 5min+ investigation spanning several EDR, SIEM, and various databases | Timelining, skills, memory, notebook |
| “What happened, root cause, progression, and scope?” across SIEM + cloud + identity | Timelining, skills, memory, notebook |
| Threat hunt that will be resumed days later | Timelining, skills, memory, notebook |
| Analyst needs linked evidence for a case writeup | Timelining, skills, memory, notebook |
| Auto-closing high-volume tier-1 alerts with no human | Timelining, memory, notebook (headless) |
| Writing detection rules or application code | Notebook to experiment; escalated detections via timelining |
| Single-query lookup inside one SIEM | Skills, memory, notebook |
If you are at Black Hat / AI4 week in Vegas, we invite you to join our sessions and free trainings at BSides, and we would love to chat with you about agentic investigations and graphs.
For those who cannot make it, we invite you to the 2-day version of our shorter BSides masterclass on agentic investigation, the Louie Early Access Program, and to catch up on our other announcements.
Notes from the trenches, monthly.
Graph analytics, GPU viz, and the occasional war story. No spam.
Thanks — we'll be in touch.