Audit Management
Audit Management is the capability management page between the Access Center and Risk Audit. It is used to configure application and runtime risk detection, manage the application tracing conversion scope, and view the ingestion status of various types of audit data.
Page overview
Audit Management provides the following capabilities:
-
Configure risk detection — Centrally manage application and runtime risk detection switches and semantic detection options.
-
View detection status — After detection is enabled, view the running status of application and runtime detection tasks and the number of high-risk events in the last 24 hours.
-
Manage custom audit rules — View the total number of rules, enabled status, and running exception summary, and go to the custom rule management page.
-
Manage the application tracing conversion scope — Select the application services whose Traces you want to convert into audit events, and view the conversion configuration status.
-
View AI application log and application tracing data — View the Agent type, Agent application name, last data time, and event volume trend over the last 24 hours.
-
View AI runtime ingestion data — View the host, Agent type, last data time, and event volume trend over the last 24 hours.
Onboarding, collection rules, and runtime probe configurations are all managed in the Audit Integration Guide.
Detection configuration
The Detection Configuration card at the top of the page displays the current configuration summary by default. After you click Edit, you can adjust the following configurations:
|
Configuration |
Description |
|
Application risk detection |
Controls application-side |
|
Runtime risk detection |
Controls runtime |
|
Basic detection |
Includes sensitive information and sensitive file checks. It takes effect automatically after either risk detection scope is enabled and cannot be disabled separately. |
|
Advanced detection |
You can independently select prompt injection, unexpected code execution, destructive operations, privilege escalation, persistence, impairment of defenses, credential access, remote control channels, unauthorized network exposure, and misrepresentation of Agent execution results. |
|
User intent analysis |
Identifies primary work intent and risk intent by user and Session. It is automatically enabled after any advanced detection capability is enabled and has no independent switch. |
Application and runtime risk detection can be enabled independently. The risk detection switches affect only risk processing and do not affect Audit Facts queries such as Session Browsing, Token Analysis, and Behavior Analysis.
When you click Save Configuration, the page submits all configurations at once. When you enable an application or runtime data source, or disable an enabled data source, prompt injection, or any execution risk detection capability, the page lists the changes and requests confirmation.
After detection is disabled, risk processing is paused. Existing detection results are not deleted.
User intent analysis uses application-side session events and currently supports the analysis of Qoder sessions. After all advanced detection capabilities are disabled, no new intent identification results are generated. Existing historical results are not deleted.
Custom audit rules
The Custom Rules section of the Detection Configuration card displays the total number of rules, the number of enabled rules, and the number of rules with running exceptions. Click Manage Rules to view the processing pipelines of behavior detection and event correlation, create rules, and manage rule switches and running status. For more information, see Custom audit rules.
Detection run status
When application or runtime risk detection is enabled, the detection run status is displayed at the top of the page:
-
Running normally — All detection tasks in the enabled scope are available, and no exceptions are found in the latest task instances.
-
Processing delay — The three latest task instances have remained in the running state.
-
Running unstable — Expected tasks are missing or not enabled, or failures occurred in recent task instances.
The status card also displays the number of high-risk events in the last 24 hours and provides an entry point to Risk Audit for further analysis. When neither application nor runtime risk detection is enabled, this card is not displayed.
The backend service centrally handles task creation, update, start, stop, and deletion, as well as the maintenance of dependent resources, based on the complete configuration. The frontend does not save task definitions, disable times, or rebuild rules. It only checks detection task status in read-only mode.
Application tracing data ingestion
If the target application is already connected to observability Traces, in the Audit Data Source Ingestion section, find Application Tracing, click Manage Conversion Scope, and select the serviceName values that you want to connect to audit. After you save the configuration, the page separately displays the AI Application Tracing Data converted from Traces.
If the same application is already connected through AI application logs, we recommend that you do not select the corresponding serviceName again. For more information about the procedure and data scope, see Connect application tracing data to audit.
AI application log data
The list supports filtering by Agent type and application name. The following table describes the fields:
|
Field |
Description |
|
Agent type |
The type identifier of the Agent |
|
Agent application name |
The application name configured during ingestion |
|
Last data time |
The time when the latest application event was received |
|
Event volume trend over the last 24 hours |
Raw event volume trend over the last 24 hours |
|
Action |
Click View to go to Session Browsing with the Agent type and application filters applied |
After application log ingestion is completed in the Access Center and events are generated, the application automatically appears in the list.
AI runtime ingestion data
The Audit Management page does not provide an entry point for runtime collection configuration. Probe rules, allowlists and blocklists, and MachineGroups are managed in the Audit Integration Guide.
|
Field |
Description |
|
Host |
The host or instance connected to runtime collection |
|
Agent type |
The Agent type identified by the runtime |
|
Last data time |
The time when the latest runtime event was received |
|
Event volume trend over the last 24 hours |
Raw event volume trend over the last 24 hours |
|
Action |
Click View to go to Session Browsing with the host filter applied |
When runtime risk detection is not enabled, raw runtime events can still be collected and browsed, but no new runtime risk processing results are generated.
FAQ
Q: Do application risk detection and runtime risk detection need to be enabled simultaneously?
No. The two can be used independently.
Q: Is historical data deleted after risk detection is disabled?
No. After detection is disabled, risk processing is paused. Existing risk data and raw logs are not deleted.