Arcanna Investigation Layer is a security investigation platform that combines agentic workflows and GenAI assistants to automate threat investigation processes. The platform is built on Google ADK (Agent Development Kit) and provides multi-step investigation capabilities that can be customized to specific organizational environments. The platform includes AI assistants that allow analysts to query security data using natural language, with support for multiple LLM providers including AWS Bedrock, Google Vertex AI, and Azure OpenAI. Agentic workflows enable multiple agents to work together on complex investigations with automated evidence gathering and report drafting. The Investigation Layer integrates with the Decision Layer for governance and control. It features a Model Repo for centralized AI model management with version control, and RAG (Retrieval-Augmented Generation) capabilities for searching organizational documentation. The platform includes a knowledge graph for identifying relationships and connections across security data. Model adaptation occurs through analyst feedback and supervised updates, with learning loops that require human validation rather than autonomous operation. The platform supports native IDE integration through MCP (Model Context Protocol) tools, allowing security teams to build, test, and deploy agentic workflows using tools like Claude Code, Cursor, or Gemini Code. All workflows are grounded in organizational ontology and institutional decisions, with execution managed through separate control and automation planes. The platform maintains human oversight throughout investigation processes while providing data control and explainable insights.