Security · Activity Log
Replay exactly what an agent did — before you remediate.
Recorder coverage — known vs guessed
The full per-event store is roadmap; this trail is reconstructed from event-family aggregates + per-agent behavior (file reads, MCP calls, run starts, risk factors). 1 shadow agent emit no telemetry — their actions are absent from the recorder entirely, the one hole instrumentation can't backfill.
52,400 events across 6 families in the window. 15 reconstructed actions are flagged, 6 tie directly to an open finding — and 1 shadow agent leave no trail at all.
events in window
6 families
flagged actions
risk-bearing behavior
tie to a finding
the why behind the worklist
agents on recorder
emitting telemetry
dark — no trail
shadow, unrecorded
Event volume — last 7 hours
recordingWhen the fleet was busy, segmented by event family. Hover any hour to read the mix.
Event-family mix
6 familiesClick a family to scope the timeline and decision log below.
Decision log — agent → action → target → outcome
reconstructed · newest firstFlagged actions lead the view — these are the events behind the open findings. Clear the filter to see the full chronological record.
read secret_file
./.env
read cloud_credentials
~/.aws/credentials
Running as root
root@svc-support-1
No tool-approval policy
root@svc-support-1
read secret_file
/var/secrets/zendesk.token
No tool-approval policy
svc-data@etl-worker-2
9.2M tokens consumed
no spend ceiling
Approvals & sandbox bypassed (yolo)
root@mktg-runner
Running as root
root@mktg-runner
Permission checks bypassed
root@mktg-runner
read secret_file
/srv/marketing-gpt/.env
No tool-approval policy
jane@jane-mbp
Sandbox disabled
dev@dev-box-7
No tool-approval policy
dev@dev-box-7
read secret_file
./config/secrets.yaml
Per-agent activity — who is doing the most
8 agents · 1 darkAgent | Observed events | Top family | Last active | Findings |
|---|---|---|---|---|
| data-pipeline-agent | 8,800 | tool | 06-03 13:40 | 1 |
| support-copilot | 3,825 | tool | 06-03 13:55 | — |
| Claude Code | 1,774 | tool | 06-03 14:02:11 | 1 |
| marketing-gpt | 1,475 | tool | 06-03 12:10 | 2 |
| Cursor | 1,292 | tool | 06-03 11:48 | — |
| Codex CLI | 740 | tool | 06-02 19:30 | 1 |
| Claude Desktop | 232 | tool | 06-03 09:20 | — |
| Zed Agent dark | no telemetry | — | 06-01 18:00 | 1 |
Findings ↔ Activity
Findings is the distilled worklist; Activity Log is the full record behind it. Reconstructed from activity.families / activity.timeline + per-agent data_access · mcp_servers · sensitive_files · factors · runs (per-event store is roadmap).