Query Agents is a suite of mission-specific AI agents built for security operations teams. Each agent is designed to perform a distinct function — triage, enrichment, threat research, or investigation — by querying data in real time through the Query Security Data Mesh, a federated data layer that accesses data where it lives without requiring data movement. The product includes six purpose-built agents: - **Detection Triage Agent:** Automatically investigates and summarizes detection findings, producing triage reports with impacted assets, evidence analysis, MITRE ATT&CK-mapped tactics, and recommended actions. - **Asset Info Agent:** Builds a real-time profile of any asset across the environment, including owner, OS, security controls, and vulnerabilities. - **File Hash Search Agent:** Locates where a file hash has appeared across the environment, enriched with first/last seen timestamps, related assets, and detection history. - **Network Activity Agent:** Surfaces network events for a given IP, including traffic patterns, asset metadata, ownership, and threat context. - **Threat Research Agent:** Parses threat intelligence reports, extracts IOCs, maps them to MITRE ATT&CK, and checks them against the environment. - **Vulnerability Intelligence Agent:** Assesses the impact of a CVE on the specific environment, identifying affected assets, exploitability, and remediation guidance. Agents operate on a unified schema with semantic understanding, referencing standards from CISA, STIX, MITRE ATT&CK, and NIST. Data is normalized into AI-ready payloads to improve LLM accuracy without requiring centralized data ingestion.