Search the whole AI trail
Answer questions about agent activity in one place. Query sessions, tool calls, commands, file access, network destinations, approvals, and blocks from one investigation surface.
After activity
Find the signal in your AI logs. Follow every action.
Hunt is the part of Signals Corps that lets you hunt for threats and run detections across your AI security logs. Show what an agent did, whether it sent candidate files in HR or changed code in engineering. Reconstruct incidents and investigate suspicious behavior faster by searching agent sessions, tool calls, policy decisions, and logs from agents, gateways, and model providers.
Hunt
Hunt
secret_access AND destination:not_approved⌘↵- Component loaded
deploy-helper / v2.4.1
- Secret file requested
.env.production
- Outbound action blocked
Destination did not match policy
Investigation across AI activity
Ask questions across the full agent activity trail.
Find out what an agent did and why, in HR, sales, or engineering, by following its sessions, tools, components, and policy decisions.
Explain why the action happened
Skip rebuilding the evidence by hand. Move from a runtime event to the user, agent, component, matched policy, approval, and outcome.
Reconstruct the incident
Turn related activity into a defensible timeline that analysts can investigate, share, and carry into their response workflow.
How it works
From suspicious activity to an investigation-ready timeline.
- 01Search
Start with an identity, session, component, command, destination, policy decision, or alert.
- 02Pivot
Follow the relationships across agents, tools, repositories, gateways, and model activity.
- 03Explain
Keep the original rule, component risk, approval, and runtime evidence with each event.
- 04Respond
Build the investigation timeline and carry the findings into existing security operations.
Hunt
secret_access AND destination:not_approved⌘↵- Component loaded
deploy-helper / v2.4.1
- Secret file requested
.env.production
- Outbound action blocked
Destination did not match policy
Investigate with the evidence already attached
Trace the action back to its origin.
Analysts resolve a suspicious outbound action faster when they can see which component was loaded, who approved the session, which rule matched, and what happened next.
- Session and cross-session timelines
- Component and runtime evidence in one view
- Identity, ownership, and approval details
- Searchable policy outcomes and exceptions
Skill · HR · 9 devicesresume-screener 1.3.0Critical rule
Skill · Sales · 14 devicescrm-export 2.1Unreviewed
MCP server · 4 devicesticket-trackerTrusted
Skill · DevOps · 12 devicesdeploy-helper 2.4.1Blocked
Hunt capabilities
Start investigations with the evidence already assembled.
AI-native search
Ask about agents and their actions directly, and check the raw fields when you need to validate.
Cross-agent pivots
See the whole incident when it spans tools by following related activity across telemetry from coding agents, gateways, and model providers.
Session timelines
Get one evidence trail for each session, with prompts, actions, approvals, policy decisions, and outcomes in order.
Saved investigations
Pick up where you left off and share the work. Queries, pivots, notes, and evidence are saved with the investigation.
Detection handoff
Catch the next occurrence automatically by turning recurring investigative patterns into reusable detections and monitoring logic.
Response exports
Hand responders investigation-ready evidence in the SIEM, case management, and response workflows they already use.
Agent logging
Logging in Cursor: get user activity into your SIEM
Which Cursor logs exist, what is inside each one, and how to send prompts, tool calls, and results from Cursor’s agent to your SIEM.
Team Platform Engineering
Signals Corps Control Plane
Reduce risk across every stage from one security platform.
Set policy, see coverage, stop high-risk actions, and investigate incidents across every agent and team from one operational view.
Write a rule once and have each control point apply it.
Know who is behind every agent, with users, devices, teams, and tools connected.
Defend every decision, with the rule, relevant details, and outcome kept together.
Roll out with one endpoint agent, then manage exceptions, approvals, and reporting in one place.
Before agents act
Find every agent and check every skill it loads.
See which AI agents run on each device, from the Claude desktop app to Claude Code, check the skills they load, and block what you don't trust.