Make host classification visible before raw session rows
The page should tell the reviewer what kind of machine this is before asking them to judge activity on it.
QI
Endpoints Detail
An endpoint detail page should make one machine legible as an execution environment: who uses it, what work appears there, and whether the host story is trustworthy.
Use This Page When Asking
Should this host be treated as a trusted execution home, or does it weaken attribution and boundary confidence?
Open c6 raw detailUsers
1
Strong owner fit
Sessions
6
Normal developer activity
Environment
developer_machine
Expected context
Trust posture
known host
Good attribution baseline
Why This Detail Matters
Important Metadata
Owner binding incomplete
This host is active in AI usage but still lacks a clear person or environment owner.
Hostname
10.0.1.44
IP Address
10.0.1.44
Environment
unknown
OS
macOS
Runtime
node
Endpoint ID
endp_01Y7w...
What This Detail Should Help Decide
Keep ownership close to the machine identity
Trust depends on whether the endpoint and user stories actually fit each other.
Use the page as a baseline for unresolved hosts
A clear known-host detail helps later investigations move faster.
Endpoint-Centered Topology
An endpoint map should show the machine, the identities on it, and the activity that originates there.
Useful per endpoint: host identity, OS/runtime posture, associated users, agent stack, models, destinations, and whether the machine fits an expected environment class.
Endpoint
10.0.1.44
Unresolved host currently tied to an active session and an unknown API key.
1 session · unknown OS
Type
unknown
Associated user
unknown
Current agent
Claude Code v1.2.0
Current credential
sk-ant-...C001
Machine Identity
What the host is supposed to be.
10.0.1.44hostname + IP
unknown OSfingerprint gap
unknown archfingerprint gap
Observed Activity
What is running there right now.
unknown user1 session
Claude Code v1.2.0agent
claude-sonnet-4-6model
Comparative Context
How this host compares with normal fleet shapes.
developer_machineexpected class
ci_runnerexpected class
outside known fleettriage path
Risk Lens
Why a machine-level view matters.
unknown key attachedcredential issue
active sessionlive activity
needs enrichmentasset inventory link
Representative Event Chain
The page should show how the item participates in a readable sequence, not just a pile of supporting rows.
- 1
Identity
The machine is classified as a concrete environment
The page should establish whether the endpoint is a developer host, CI lane, or something unresolved immediately.
alice-mbp.localMacOS arm64developer_machine - 2
Ownership
Known users give the host a trust floor
Strong user fit and repeated activity on one machine make the endpoint easier to trust quickly.
alice@company.com6 sessions - 3
Work shape
Recent sessions explain why this host matters now
Sensitive work, unusual models, or new behavior should be visible as part of the host story rather than only in other tables.
recent sessionsclaude-sonnet-4-6 - 4
Comparison
The reviewer compares the host against unresolved peers
A strong endpoint baseline helps the reviewer spot why a weakly labeled host deserves escalation.
unknown endpointsession detail
c6 Evidence Tables
Users On This Endpoint
c6 starts with attribution around the host.
| User | Primary agent | Sessions | Last seen |
|---|---|---|---|
| unknown | Claude Code | 1 | 22 min ago |
Recent Sessions
The raw page then shows the work actually happening there.
| User | Agent | Model | Cost | Status |
|---|---|---|---|---|
| unknown | Claude Code | claude-sonnet-4-6 | $0.61 | active |
| sandbox-evals | Cursor | claude-opus-4-6 | $1.94 | ended |
Return To Category
Compare this representative detail against the full category framing and drill targets.
Open Endpoints overviewOpen c6 Raw Detail
Use the original detail page for exact raw evidence after the c12 story framing.
Open c6 raw detailOpen c6 Raw List
Compare this item against the broader c6 entity ledger once the representative story is clear.
Open c6 raw list