Sessions
The subtitle states the scope: “Sessions in the last 24 hours · newest first · root sessions only”. A root session has no parent; sessions it spawned appear on its detail page under Child sessions. Controls. Time range (default Last 24 hours), Newest first, All machines, platform All, “Search sessions, hosts, users, agents…” and the Root sessions toggle. Tiles. Sessions, Active, With findings (“Sessions that raised at least one divergence finding”), High risk (“Sessions whose highest composite risk is 70 or more”) and Events. High risk means a composite risk of 70 or more, a triage signal rather than a judgement.
Empty states. “No sessions in this range”. “No sessions match these filters”: “The server searched every session in the range; none matched. Clear a filter or widen the range.” “Too large to answer live”: “The server stopped this query at its time limit. Narrow the range, pick a machine, or search to list sessions.” “Search isn’t available yet” when search is not served.
Session detail
Header tiles Actions, Spawned, Findings, Max risk; a Live or Ended badge; Copy ID, View in graph, Parent session. Panels: Activity timeline, Session info (Working dir, Agent ID, Platform, Spawned by, Parent session, Model and more), Child sessions, Risk summary, Process lineage, Capability distribution, and panels for the conversation, findings, MCP inventory and intent scope. A session that is gone reads “Session no longer exists or expired”. Sessions are kept 365 days and events 14 to 45, so an old session can outlive its events. Terminate agent opens “Terminate this agent?” with Reason (optional) and Terminate. It needs Admin or Owner: “Terminating an agent needs the admin role or higher on this workspace.”Live Activity
When nothing at all was captured in the window, the page reads “No events captured yet.” with its own description: “This view shows real scored actions from OS-level capture. Rows appear as soon as an agent runs a tool call on an instrumented host. An empty view means nothing has been captured — not that nothing happened.” Panels. Throughput shows the rate per second; with too little data: “Fewer than 2 timestamped actions — no rate shape to draw.” Decision mix counts actions by decision, and each row is a filter. Top agents, Top tools and Top platforms rank the window. Action stream columns: Time; Disposition, the decision recorded on the action; Agent; Tool, the tool it called; Risk, the action’s risk score; Target, what the action was aimed at. The decision words are the product’s own labels: allowed, logged only, held for review, alert raised, blocked, and no decision when none was recorded. In shadow mode every action reads logged only; the Policies page shows what each rule would have done. Filters. Agent, tool and platform, carried in the page address so a view can be shared; Clear all resets them. While you read, the feed holds (“Feed held while you read · Show new actions”) until you click Resume. When a filter matches nothing, the stream reads “No action in this window matches the current filter.”; that is the filter, not an empty fleet, and Clear all brings the rows back.Agents
The subtitle: “AI agents detected on N of M enrolled hosts · as of” followed by the time of the read. The range defaults to Last 7 days; Refresh re-reads. Tiles. Agents (“N kinds · identified installs”), Hosts with agents (“of the enrolled fleet”), Sessions (“the last 7 days · no change vs previous 7 days”) and Unclassified processes, which reads “every detected process matched a known agent” when none is unclassified. Agents on the fleet, one row per agent kind: Agent, Hosts, Sessions, Activity, Active now, Incidents, Models, Last seen. Installs, one row per install: Agent, Identification, Host, Status, First seen. Search with “Search agents…”; filter by host (All hosts), identification (All, Identified, Unclassified) and status (Any status, Active, Inactive); sort by Last seen. When host names are hidden from your account: “Host names are unavailable to this account, so hosts are shown by machine id.” Empty states. “No identified agents on the fleet”: “Nothing the sensors could identify as an AI agent ran on the N enrolled hosts in the last 7 days.” With filters, “No installs match”: “Nothing detected on the fleet matches these filters. Clear a filter to widen the view.”Agent detail
Tiles Sessions, Active now, Incidents, Findings. Sections: Activity; Sessions (Session, Working directory, Model, Started, Events, State; empty “No root sessions recorded for this install…”); Incidents (“No incidents recorded for this install.”); Findings; Identification, what the install was detected as. View in identity graph opens the graph on this agent. An unknown id reads “No agent with this id”. Nothing on these three pages writes except Terminate agent, which needs Admin or Owner.Next
- Investigate a finding when a session shows findings.
- Data Sources, Inventory, Tool Surface and Identity Graph for the hosts themselves.