Security intelligence

What triggers an alert

• New sensitive action — the first time an agent ever attempts a high- or critical-risk action.
• Block spike — an unusual number of blocked actions from one agent in a short window.
• Failure loop — the same action failing repeatedly in a short window.
• New tool usage — the first time an agent uses a given category of action.
• High-risk burst — several high/critical-risk actions from one agent in a short window.
• Cost spike — a day’s spend for an agent that’s a large multiple of its recent trailing average.

What every alert tells you

Every alert is designed to answer four questions: what happened, why it’s unusual, what evidence triggered it (with any secret-shaped fields redacted), and what to inspect next — with direct links to the related activity, agent, and policy evaluations.

Deduplication

A repeat trigger of the same alert type for the same agent within 24 hours updates the existing open alert rather than creating a new one for every occurrence — so reviewing an alert’s history stays readable instead of one row per repeat.

Acting on an alert

From an alert’s detail page you can acknowledge it, resolve it, jump straight into creating a policy that would prevent it from recurring, or pause the agent that triggered it — a real action that actually blocks that agent’s future evaluations, not a cosmetic status change.