Entity Investigation-AgentLoop(AgentLoop)-阿里云帮助中心

Page overview

While Risk Audit helps you discover "which risks need priority attention," Entity Investigation further answers "what other context is this risk object involved in." For example, when a Secret, sensitive file, outbound domain, destination IP, user, host, or tool appears in Risk Audit, you can navigate to Entity Investigation to see whether the object has appeared multiple times, which applications or sessions it involves, and whether it co-occurs with other high-risk objects.

Entity Investigation is suitable for assessing impact scope and investigation priority. You can use it to understand an entity's risk level, active time, associated sessions, associated applications, related risk types, and co-occurring objects, and then decide whether to replay a single Session first or expand the investigation to the same user, host, application, or outbound target.

Use cases

Scenario	How to use
Assess the impact scope of sensitive information	Select a Secret, PII, or sensitive file entity and view the sessions, applications, and hosts where it appeared.
Investigate outbound risks	Select a domain or destination IP and view which Agents, users, or tools are associated with the outbound target.
Investigate anomalous users or hosts	Select a user, host, or Agent host IP and view its associated risks, session count, and co-occurring objects.
Understand tool or command risks	Select a Tool, command, or Action and view whether they frequently appear in risk sessions.
Expand the investigation scope	Navigate from one entity to the relationship graph to discover other entities that co-occur in the same risk context.

Entity types

Entity Investigation organizes risk-related objects by type, allowing you to enter the investigation from different angles.

Entity type	Description
Secret / PII	Keys, access credentials, connection strings, phone numbers, email addresses, and other sensitive data.
File path	Paths involving sensitive files or risk-related file changes.
Domain / Destination IP	Outbound domains, URLs, or network peers accessed by the Agent.
Application / Agent type	Agent applications and Agent types that generated risks or audit data.
Host / User / Agent host IP	Agent runtime environment, operator, and IP address of the host where the Agent runs.
Tool / Skill	Tools invoked or Skills used by the Agent.
Model provider	Provider or service boundary associated with model requests.
Command / Action	Shell commands, executables, or key operational actions.

Page structure

The Entity Investigation page typically consists of entity classification, entity list, and entity details.

Entity classification

The entity classification panel on the left provides a quick overview of the quantity and risk distribution of different entity types. You can first select a type such as Secret, file path, domain, host, user, or Tool, and then view the specific entities of that type on the right.

Entity classification answers "which type of objects are risks concentrated on." For example, if the Secret type has many high-risk entities, credential exposure requires priority attention. If domains or destination IPs show high concentration, outbound targets and data exfiltration paths require attention.

Entity list

The entity list displays the entities of the current type and their risk summaries. You can use information such as entity name, risk level, associated session count, and associated application count to determine investigation priority.

The entity list answers "which objects are most worth investigating first." Typically, prioritize entities with higher risk levels, more associated sessions, more affected applications, or recent activity.

Entity type overview

The entity type overview provides a holistic view of the risk distribution of the current entity type, including total entity count, high-risk entity count, associated sessions, and associated applications.

This section helps you determine whether risks are concentrated under the current filter conditions. If one entity type has a notably higher high-risk count, start investigating from that type. If risks are widely distributed, use the time range, Agent type, or specific application to further narrow the scope.

Entity details

After you click an entity, you can view its entity profile, session appearances, and relationship graph in the details.

Entity profile

The entity profile summarizes the basic information and risk overview of the entity, such as entity type, display name, first seen time, last active time, associated session count, associated application count, associated Agent type count, and risk summary.

The entity profile helps you quickly determine "is this entity important, is it still active, and how broad is its impact." For example, a Secret that is still recently active, associated with multiple applications, and involved in high-risk events is typically more worth handling first than a low-risk entity that appeared only once in a single historical session.

Session appearances

Session appearances display the related Sessions where the entity appeared. You can enter a specific session to view model requests, model responses, tool calls, and tool results to understand the context in which the entity appeared.

Session appearances answer "how was this entity used or exposed." For example, you can confirm whether a Secret was introduced by user input, a tool return, a file read, or model output. You can also check which tool accessed an outbound domain, whether sensitive information was carried, and whether the access aligns with the task objective.

Relationship graph

The relationship graph displays the co-occurrence relationships between the current entity and other entities, such as users, hosts, applications, Tools, file paths, domains, destination IPs, or Secrets that appear in the same session.

The relationship graph answers "what other objects should also be investigated." For example, from an outbound domain you can discover related Tools and users. From a Secret you can discover its associated applications, hosts, and sessions. From a suspicious command you can discover whether it is also associated with sensitive files or external targets. You can follow the relationship graph to continue tracing, progressively expanding or converging the investigation scope.

Usage recommendations

Phase	Recommended action
Discover entities	Navigate from Risk Audit to Entity Investigation, or browse high-risk entities by type in Entity Investigation.
Determine priority	Combine risk level, last active time, associated session count, and associated application count to select priority investigation targets.
Review context	Navigate from session appearances to Audit Facts to view the complete event timeline before and after the entity appeared.
Expand investigation	Use the relationship graph to view co-occurring objects and determine whether to continue investigating the same user, host, application, Tool, or outbound target.
Converge conclusions	Combine the entity profile, session context, and relationship graph to determine the risk impact scope and handling priority.

Relationship with other pages

Page	Relationship
Risk Audit	Discover priority risks from the risk aggregation perspective, then navigate to Entity Investigation to view the impact scope and associated objects.
Audit Facts	Replay Sessions where the entity appeared and view the raw event timeline and tool call context.
Audit Management	Confirm whether application risk audit or runtime risk audit is enabled and whether relevant data is being continuously ingested.