# Investigations at machine speed

An agent that has to wait five minutes for a query does not investigate — it guesses. CtrlB puts your complete operational history behind an interface fast enough for an agent to ask twenty questions in the time a data lake answers one.

## Metadata

- **Canonical HTML**: https://ctrlb.ai/solutions/ai-agent-investigations
- **Section**: Solutions — AI agent investigations

## At a glance

| Figure | What it refers to |
|--------|-------------------|
| 10 min → 500 ms | Production agent queries |
| 20 questions | In the time a lake answers one |
| MCP native | Agents query without a scraper |
| 0 sampling | Complete history, every query |

## What agents hit today

- Query latency measured in minutes, so an agent can afford two or three questions per investigation instead of twenty.
- Rate limits and per-query costs designed for humans clicking dashboards, not for a machine issuing sustained query volume.
- Sampled traces and 30-day retention, so the evidence the agent needs was discarded before the question was asked.
- Screen-scraping a dashboard UI, or a bespoke export pipeline that goes stale the moment the schema moves.

## What CtrlB gives them

- Sub-second point search across petabytes, so an agent can branch, backtrack, and re-ask without a human waiting.
- Stateless query nodes that fan out on demand, so machine-scale query volume costs compute rather than a bigger cluster.
- Complete unsampled history on your own object storage, so the answer does not depend on what someone chose to keep hot.
- An MCP interface over the same data layer humans query, so the agent and the on-call engineer see identical evidence.

## How it works

1. **Land everything in your bucket** — Logs, metrics, and traces are written as open Parquet into object storage you own. Nothing is sampled on the way in and nothing ages out into a tier you cannot query.
2. **Index at ingest, not at query** — Compact inverted indexes are built as data lands, and they live next to the data in your bucket. A point search reads the index and a handful of Parquet row groups instead of scanning the lake.
3. **Answer at agent speed** — Query nodes are stateless and hold no local data, so a burst of agent traffic fans out across spot instances and scales back to zero when the investigation ends.

## Capabilities

- **MCP interface**: Agents query telemetry directly over Model Context Protocol — no dashboard scraping, no bespoke export job to maintain.
- **Full-text and SQL**: The same data layer answers a free-text needle search and an aggregate SQL query, so agents do not need two backends.
- **Complete history**: Years of retention on object storage pricing, with every retained day queryable at the same speed as today's data.
- **Sustained query volume**: Concurrency is a compute decision, not a licensing tier. Agents are not throttled for asking too many questions.
- **Same evidence for humans**: When an agent hands off to an engineer, the engineer opens the same query against the same data — no reconciliation step.
- **Your bucket, your data**: Open Parquet in your own S3 or GCS. Point another engine at it whenever you want; there is nothing to export.

## FAQ

**How do agents actually connect?**

Through CtrlB's MCP interface, which exposes search and SQL over the same data layer the UI uses. An agent authenticates, issues queries, and reads results without any screen scraping.

**What happens to cost when an agent runs hundreds of queries?**

Storage cost is object storage cost and does not move. Query cost is the compute the queries actually consumed, on stateless nodes that scale to zero afterwards — there is no per-seat or per-host multiplier on agent traffic.

**Does the agent see sampled data?**

No. Data is written complete to your bucket, so an agent investigating last quarter's incident reads the same fidelity of evidence as one investigating this morning's.

**Can we keep our existing dashboards?**

Yes. CtrlB can sit underneath the tools you already run — see extending your existing stack.

Markdown mirror: fetch `/solutions/ai-agent-investigations.md` for this page as plain Markdown.