What it does
You give it an incident description and the questions you want answered. It narrows the log stream structurally — by resource, log name and severity rather than by free-text search — pins the earliest failing entry, and correlates it against the audit log to find the change that preceded it. Findings cite the exact filter and time window behind each claim, so a conclusion can be reproduced by running the same query yourself.What it reads
Read-only, and one source.Before you deploy
The connection is required rather than optional, because the gateway is this agent’s only path.
There is no alternative tooling bundled alongside it, so without a connection it has no tools at
all.
Ask it for
In chat, or as a run’s prompt:incident_description, questions, affected_services,
investigation_start, context and budget_seconds.
Defaults and limits
The time budget degrades rather than fails. At 70% the agent is nudged to converge; at 100% further
tool calls are refused and it reports what it has.
In a workflow
This is a specialist with a narrow surface, which makes it a good first step rather than a sole one: it establishes when the failure started and what changed around it, and an orchestrator takes that timestamp to the specialists that hold the rest of the picture. See Orchestration for how a step delivers work to it.What it will not do
It never writes to Google Cloud, and it reads nothing outside Cloud Logging. Metrics, traces, resource configuration and billing are all outside its reach — so where a cause lives in one of those, it establishes the timeline and says plainly that the rest is not something it can see. It is also scoped to the single project its service-account key belongs to.Next steps
Integration groups
Scope the gateway tools this agent is given.
AWS Infrastructure Investigator
A broader cloud investigation, over AWS.
Runs & evidence
Read the queries behind a finding.
Agent catalog
Every catalog agent, side by side.