Search the whole AI trail
Query sessions, tool calls, commands, file access, network destinations, approvals, and blocks from one investigation surface.
After activity
Find the signal in your AI logs. Follow every action.
Search agent sessions, tool calls, policy decisions, and logs from agents, gateways, and model providers to reconstruct incidents and investigate suspicious behaviour.
Hunt
Hunt
secret_access AND destination:not_approved⌘↵- Component loaded
deploy-helper / v2.4.1
- Secret file requested
.env.production
- Outbound action blocked
Destination did not match policy
Investigation across AI activity
Ask questions across the full agent activity trail.
Follow suspicious behaviour across sessions, users, agents, tools, components, and policy decisions while the original evidence stays attached.
Explain why the action happened
Move from a runtime event to the user, agent, component, matched policy, approval, and outcome without rebuilding the evidence by hand.
Reconstruct the incident
Turn related activity into a defensible timeline that analysts can investigate, share, and carry into their response workflow.
How it works
From suspicious activity to an investigation-ready timeline.
- 01Search
Start with an identity, session, component, command, destination, policy decision, or alert.
- 02Pivot
Follow the relationships across agents, tools, repositories, gateways, and model activity.
- 03Explain
Keep the original rule, component risk, approval, and runtime evidence with each event.
- 04Respond
Build the investigation timeline and carry the findings into existing security operations.
Hunt
secret_access AND destination:not_approved⌘↵- Component loaded
deploy-helper / v2.4.1
- Secret file requested
.env.production
- Outbound action blocked
Destination did not match policy
Investigate with the evidence already attached
Trace the action back to its origin.
A suspicious outbound action becomes more useful when the analyst can see which component was loaded, who approved the session, which rule matched, and what happened next.
- Session and cross-session timelines
- Component and runtime evidence in one view
- Identity, ownership, and approval details
- Searchable policy outcomes and exceptions
Hunt capabilities
Start investigations with the evidence already assembled.
AI-native search
Search agent security entities and actions directly, with raw fields available for validation.
Cross-agent pivots
Follow related activity across telemetry from coding agents, gateways, and model providers.
Session timelines
Order prompts, actions, approvals, policy decisions, and outcomes into one evidence trail.
Saved investigations
Preserve queries, pivots, notes, and evidence so analysts can resume and collaborate.
Detection handoff
Turn recurring investigative patterns into reusable detections and monitoring logic.
Response exports
Share investigation-ready evidence with SIEM, case management, and response workflows.
Shared control plane
Reduce risk across every stage from one security platform.
Set policy, see coverage, stop high-risk actions, and investigate incidents across every agent and team from one operational view.
Author once and adapt decisions to each control point.
Connect users, agents, teams, tools, and repositories.
Keep the rule, relevant details, decision, and outcome together.
Manage rollout, exceptions, approvals, and reporting.
Before agents act
Verify every component they trust.
Verify agent components before they enter your environment.