Risk Audit-AgentLoop(AgentLoop)-阿里云帮助中心

Page overview

Risk Audit contains the following tabs:

Tab	Description
Overview	View the overall risk level, high-severity risk distribution, trends, and risk localization.
Risk Explorer	View risk events and detection findings in a unified view, with support for multi-dimensional filtering, precise locating, sorting, and risk detail viewing.
User Risk	Aggregate risks by user, and view the risk profile, associated entities, and all risk records of a single user.
Intent Audit	View normal work intents, risky intents, token consumption, and determination basis by user and Session.

Risks such as sensitive data exposure, sensitive file mutation, prompt injection, and unexpected code execution are filtered by risk type and risk subtype in Risk Explorer and are no longer displayed as separate tabs.

Top-level unified filters

The top-level filters determine the current query scope and are linked with the metrics, charts, and lists of the current tab.

Filter dimension	Description
Data scope	Select AI Application Audit or AI Runtime Audit.
Agent type	Filter by Agent type, such as Qoder, Cursor, or Claude Code.
Agent application	Select all applications or a specific application.
Query time range	Select the time window for risk analysis. The last 24 hours is displayed by default.

Intent Audit is based on application-side session analysis. When you use this tab, set the data scope to AI Application Audit.

Overview

The Overview answers: "What is the current risk level, where do risks primarily come from, and which risks should be investigated first?"

Section	Description
Key metrics	Displays key metrics such as high-severity risks, new risks, and affected Sessions and applications.
High-severity risk distribution	When no risk category is selected, displays the composition by risk category. After you select a category, displays the composition by its risk subtypes.
Trends	Displays risk changes over time.
Risk localization	Locates risk concentration points by dimensions such as application, Agent, user, host/container, tool, and destination.
Risk detail entry	Open the risk details to view evidence and continue the investigation.

Risk Explorer

Risk Explorer consolidates different types of risk results into a single query and investigation interface.

Select a result type

Result type	Description
Risk events	Displays risks that have been correlated, filtered, or supplemented with additional determinations, which are better suited for sorting and disposition.
Detection findings	Displays security-related signals identified from Agent activity, which are suitable for evidence tracing, rule verification, and secondary analysis.

If you need to handle risks that already have a clear conclusion, we recommend that you first view Risk events. If you need to verify custom behavior detection rules or view rawer hit results, select Detection findings.

View metrics and trends

The top of the page displays the total number of risks, the number of critical and high risks, the number of affected Sessions, and the number of risk types within the current filter scope. The trend chart displays changes in both all risks and critical and high risks. Select a time period in the trend chart to further narrow the query scope.

Filter risks

By default, the filter panel on the left provides dimensions such as risk type, risk subtype, severity, user, and Skill. After you expand More filter dimensions, you can also filter by detection identifier, host/container, Agent host IP, model provider, tool, destination domain, and destination IP. Filters are linked with the metrics, trends, and result list on the page.

The available filter fields may vary depending on the data scope and ingested data.

Selected conditions are displayed as tags above the list. Click a tag to remove the corresponding condition, or click Clear filters to reset all conditions.

Quick locating

Select an application, Session, user, entity value, or detection identifier, enter an exact value, and then add the locating condition. This feature is suitable for narrowing the results directly from a known Session ID, custom rule identifier, or key entity.

Sort and view details

Results support two sort orders: Latest first and Severity first. The list displays severity and confidence, risk summary, risk type and subtype, application and user, detection identifier, and occurrence time. Click any row to open the risk details and continue to view the evidence and Session context.

User Risk

User Risk organizes risks around users and is suitable for locating users or credential holders who continuously trigger risks.

The risk user list summarizes the number of high-severity risks, total risks, risk sessions, and the latest risk time for each user. Click a user row to go to the user details, where you can view the user overview, risk time distribution, risk composition, associated entities, and specific risks.

All statistics in User Risk are affected by the current query time range. When you determine whether a user continuously generates risks, we recommend that you view both the risk time distribution and the specific risk records.

Intent Audit

Intent Audit helps you understand what work users mainly accomplish with Agents and whether they have expressed anomalous or malicious goals. The page displays intent and risky intent metrics, intent distribution, risky intent summary, token consumption distribution, user Agent usage overview, and risky intent details.

A risky intent indicates that the user has expressed an anomalous or malicious goal, but does not mean that the Agent has successfully performed the corresponding action. Use risk events and Session context to determine whether an actual impact has occurred.

Data state

The metrics, charts, and lists on the page display their query states separately. If a section fails to load, you can still view the other sections that have returned data. If there is no data within the current filter scope, first confirm that audit data has been ingested and the corresponding detections are enabled, and then broaden the query time range and filter conditions as needed.

Usage recommendations

Phase	Action	Description
Discovery	Review the key metrics, trends, and risk localization on the Overview tab	Assess the current risk level and priorities.
Localization	Go to Risk Explorer	Narrow the scope by risk type, subtype, severity, user, entity, or detection identifier.
Attribution	Go to User Risk or open the risk details	Understand the impact scope from users, applications, hosts, and key entities.
Investigation	Navigate to Session Browsing or Entity Investigation	View the complete interaction context, evidence, and associated behaviors.