InvestigateActivity and investigations

Activity and investigations

Activity is the operational audit stream for runtime decisions. It is where admins confirm that an agent is connected, verify policy behavior, and start investigations when an event needs review.

Activity is the operational audit stream for runtime decisions. It is where admins confirm that an agent is connected, verify policy behavior, and start investigations when an event needs review.

Event types

TypeWhen it appearsWhat to check
PASSA benign tool call was allowed and full audit logging is enabled.Source, tool, host, person, policy reason.
WARNA tool call was allowed but flagged.Detector reason, policy pack, whether the warning should become a block.
BLOCKA tool call was denied by policy or detector response.The blocked target, reason, source, and user impact.
SystemWorkstation registration, setup health, self-test, lifecycle event.Whether the install exists and points to the right AgentKeeper origin.

If Activity shows system events but no runtime events, the workstation likely registered successfully but the live hook path is not firing.

Reading a row

For enterprise review, the most important columns are:

  • Time: when AgentKeeper received the event.
  • Verdict: PASS, WARN, BLOCK, or system.
  • Source: the integration that produced the event, such as claude_code, claude_chat, cowork, codex, mcp_gateway, or openai_compliance_api.
  • Host: the workstation that produced the event.
  • Tool: the action surface, such as Read, Bash, WebFetch, or an MCP tool.
  • Reason: the policy or detector explanation.
  • Session: the session that groups related events.

The source must match the product path being tested. A Claude Chat install should produce claude_chat or Gateway-routed MCP activity, a Cowork install should produce cowork runtime events, and ChatGPT Enterprise Compliance API sync should produce openai_compliance_api audit rows.

Prompt and payload detail

Rows intentionally show compact summaries. Use the event drawer for evidence:

  • Full prompt means prompt retention is enabled and AgentKeeper stored the prompt text for that event.
  • Prompt summary means the event came from older data or a source that only retained the bounded row summary.
  • Prompt logging disabled means the prompt was evaluated for policy, but the prompt body was not retained.
  • Raw JSON shows the retained event context after Prompt Vault-safe serialization. Deep-capture tool payloads appear there when enabled and supported, except protected prompt fields in Sealed Evidence or Promptless mode.

Disabling prompt or tool-detail retention does not weaken enforcement. AgentKeeper still evaluates the live hook payload before deciding PASS, WARN, or BLOCK; the setting only controls what remains in the audit record.

Investigation handoff

Use an investigation when a single event is not enough context. Typical handoffs:

  1. A BLOCK event stops a tool call and the developer asks why.
  2. A WARN event points to a suspicious sequence that needs review.
  3. Multiple PASS events show a chain that is benign individually but risky together.
  4. A setup problem affects multiple workstations in the same deployment cohort.

Filters that matter

  • Filter by source during setup validation.
  • Filter by verdict when proving PASS and BLOCK behavior.
  • Filter by host during fleet rollout.
  • Filter by person or group when validating policy-pack assignment.
  • Search by tool, domain, file path, or session during incident review.

When Activity is not enough

If an expected event is missing, Activity cannot prove whether the tool never ran, the hook never loaded, or the event went to another environment. Use:

Was this page helpful?