Audit Facts-AgentLoop(AgentLoop)-阿里云帮助中心

Page overview

Audit Facts directly describes raw sessions, model requests and responses, tool calls, tool results, and runtime behaviors reported by the Agent. It does not depend on the risk audit switch being enabled. When the risk audit switch is off, Risk Audit and Entity Investigation may only display historical risk data, but Audit Facts remains available for verifying ingestion results, troubleshooting context, and analyzing token and behavior trends.

The top of the page provides unified filters: data scope, Agent type, and query time range. The data scope currently provides two scopes: AI Application Audit and AI Runtime Audit. The default query time range is the last 7 days.

Page structure

The Audit Facts page contains three tabs:

Tab	Description
Session Browsing	Filter sessions by host, user, Agent application, Agent host IP, Tool, Session ID, and other dimensions, and view context timelines.
Token Analysis	Analyzes input tokens, output tokens, total tokens, model distribution, time trends, and high-consumption sessions.
Behavior Analysis	Analyzes Agent activity, model requests, tool calls, command execution, external interactions, errors, and Session rankings from a neutral behavior perspective.

Session Browsing

Session Browsing uses a left-right split layout:

Left panel: Session list showing sessions that match the filter conditions.
Right panel: Full context details of the selected Session.

Top-level statistics

The top of the page displays overall statistics for the current filter scope:

Metric	Description
Sessions	Total number of matching sessions
Events	Total raw event count
Turns	Number of user-Agent interaction rounds
Steps	Number of Agent execution steps
LLM Request	Number of LLM model requests
Input Tokens	Total model input token count
Output Tokens	Total model output token count
LLM Response	Number of LLM model responses
Tool Call / Result	Number of tool calls and return results

Filter conditions

Session Browsing supports the following filter dimensions:

Filter	Description
Time range	Located in the unified filter at the top of Audit Facts. Default is the last 7 days.
Agent type	Located in the unified filter at the top of Audit Facts.
Host	Filter by Agent runtime host.
User	Filter by user dimension.
Agent application	Filter by application name.
Agent host IP	Filter by the IP address of the Agent runtime host.
Tool	Filter by tools used.
Session ID	Filter or locate a session by a specific Session ID.

Filter inputs support querying candidate values after you enter a prefix, and return matching values with session counts.

Locating sessions

The page mainly locates sessions through filters. You can select or enter the target Session in the Session ID filter, or navigate to Audit Facts from pages such as Risk Audit and Entity Investigation to view the context of the corresponding session.

Session list

The Session list displays summary information for matching sessions:

Field	Description
Session ID	Unique session identifier
Tool summary	Main tools used in the session
Host / Agent application	Runtime host and application name
User / Agent type	User identifier and Agent type
Agent host IP	IP address of the Agent runtime host
Event	Total raw event count
Turn	Interaction round count
Step	Execution step count
Req / Resp	LLM request count / response count
Tool Call / Result	Tool call count / result count
Last active	Timestamp of the most recent event

The list is paginated. Click a row to display the Session context in the right panel.

Session context details

After you select a Session, the right panel displays the complete event timeline for that Session.

Event types

The timeline displays the following types of raw events:

Event type	Label	Description
Other event	other	Session-level metadata events
LLM Request	Request	Request sent to the model, including messages input
LLM Response	Response	Response returned by the model, including assistant output
Tool Call	tool call	Tool invocation initiated by the Agent, including tool name and parameters
Tool Result	tool result	Return result from tool execution

Event information

Each event displays the following information:

Event ID: Globally unique identifier.
Turn / Step: The interaction round and step number that the event belongs to.
Timestamp: The precise time when the event occurred.
Content summary: Key content displayed based on the event type, such as user input, model output, tool parameters, and results.

Token Analysis

Token Analysis observes model call costs and context consumption, answering: "Which models, applications, or sessions consumed the most tokens, and is the consumption concentrated in a few long sessions or anomalous requests?"

Token Analysis typically includes the following information:

Module	Description
Token overview	Displays input tokens, output tokens, and total tokens.
Model distribution and trends	Displays token consumption by model and observes time trends.
Session ranking	Displays high-consumption sessions and supports navigation to Session Browsing to view the context.
Token bucket distribution	Observes long context and anomalous consumption by Turn or Session token consumption ranges.

Token Analysis is an audit facts view and does not indicate that a security risk is confirmed. If anomalous consumption is detected, use Session Browsing and Behavior Analysis to confirm whether loop calls, repeated tool failures, excessively long context, or anomalous model requests exist.

Behavior Analysis

Behavior Analysis observes Agent activity from a neutral behavioral perspective and does not directly equate to risk detection results. It answers: "Which applications are most active, which tools are frequently called, and are there large volumes of command execution, external interactions, or tool errors?"

Behavior Analysis typically includes the following information:

Module	Description
Activity metrics	Displays overviews such as active Agents, session count, model requests, and total behavior volume.
Tools and commands	Collects statistics on tool calls, command execution, command families, and tool errors.
External interactions	Collects statistics on behaviors related to external targets, domains, or network interactions.
Session ranking and timeline	Locates sessions with anomalous behavior volumes and navigates to Session Browsing to replay the context.

Behavior Analysis helps users understand normal behavior baselines and can also provide background for risk investigations. For example, when Risk Audit detects sensitive data exfiltration, you can use Behavior Analysis to check whether the same application or host also exhibits anomalous external interactions or tool errors.

Cross-page navigation and context positioning

Audit Facts serves as the context viewing entry point for other audit pages. When you need to view raw sessions from Risk Audit, Entity Investigation, or Audit Management, you can navigate to Audit Facts and view the event timeline of the corresponding Session in Session Browsing.

When you navigate from Risk Audit, you can use the Session information in the risk details to return to the raw session and view the model requests, model responses, tool calls, and tool results before and after the risk occurred. When you navigate from Entity Investigation, you can view the session context in which a specific entity appeared. When you navigate from Audit Management, you can verify whether a specified application or host has produced audit data.

This capability supports the continuity of investigation paths: you can navigate from risks, entities, or ingestion status back to raw audit facts. However, the Audit Facts page itself only provides browsing, filtering, and context viewing capabilities, and does not provide risk annotation or disposition functions.

Use case examples

Scenario 1: View raw context from a security event

View the details of a risk in Risk Audit.
Note or navigate to the Session associated with the risk.
In Session Browsing under Audit Facts, view the raw event timeline of that Session.
Combine model requests, model responses, tool calls, and tool results to understand the complete process before and after the security event.

Scenario 2: Investigate anomalous token consumption

In Token Analysis under Audit Facts, identify a Session with anomalously high consumption.
Navigate to Session Browsing, or locate the Session in the Session ID filter.
Review LLM Request/Response events to check for excessively long context or repeated calls.
Use tool call events to confirm whether loop calls or failure retries exist.

Scenario 3: Verify ingestion data completeness

On the Audit Facts page, filter by a recent time range and the target Agent type.
Review the top-level statistics in Session Browsing to confirm that the Session count and Event count match expectations.
Open a specific Session to view the event timeline and confirm that Turn, Step, Request/Response, and Tool Call/Result events are complete.
If events are missing or fields are incomplete, check the ingestion configuration and the status of the collection components.