Activity · What happened?
Replay exactly what an agent did — before you remediate.
Incident response needs the full record, not the headline. Reconstruct the agent → action → target → outcome trail behind every finding, filter to the flagged actions, and pivot to the agent.
Bottom line
52,400 events across 6 families in the window. 15 reconstructed actions are flagged, 6 tie directly to an open finding — and 1 shadow agent leave no trail at all.
Recorder coverage — known vs guessed
The full per-event store is roadmap; this trail is reconstructed from event-family aggregates + per-agent behavior (file reads, MCP calls, run starts, risk factors). 1 shadow agent emit no telemetry — their actions are absent from the recorder entirely, the one hole instrumentation can't backfill.
52,400
events in window
6 families
15
flagged actions
risk-bearing behavior
6
tie to a finding
the why behind the worklist
7
agents on the recorder
emitting telemetry
1
dark — no trail
shadow, unrecorded
Event volume — last hours
When the fleet was busy. 52,400 events total in the window.
By event family
Decision log — agent → action → target → outcome
reconstructed · newest firstFlagged actions lead the view — these are the events behind the open findings. Clear the filter to see the full chronological record.
Per-agent activity — who is doing the most
Findings is the distilled worklist; Activity Log is the full record behind it — open Findings →. Reconstructed from activity.families / activity.timeline + per-agent data_access · mcp_servers · sensitive_files · factors · runs in app/data/c16-fleet.ts (per-event store is roadmap).