Incident response requires precision across diverse technology platforms. Responders manage significant cognitive demands while evaluating EDR alerts, cloud telemetry, and forensic artifacts during investigations with tight deadlines. This session examines the benefits of integrating coding agents like the Gemini CLI into digital forensics and incident response workflows.

We demonstrate how the use of sub-agents keeps the context window clean, which results in more predictable workflows and limits hallucinations. By enabling these sub-agents to use Agent Skills and MCP tools, investigators can rapidly develop capabilities tailored to solve specific common reasoning based analytical tasks. Operating a coding agent directly alongside the data eliminates the need for complicated pipelines by enabling the agent to process the data iteratively using the same CLI tools that the analysts were using. This CLI first approach also acts as a starting point for automating repeatable and deterministic tasks that can trivially be wrapped into automation scripts.
The presentation also addresses the risks and controls concerning prompt injection. Attendees will observe this architecture in practice through real field examples. Participants will leave with practical design patterns and a framework for determining when to use a general coding agent versus building a dedicated agent.