Risk Event Field Reference-AgentLoop(AgentLoop)-阿里云帮助中心

This topic is intended for users who need to configure risk notifications, write secondary analysis logic, or integrate with external security systems. It describes the fields of the high-fidelity security event table incident-event and the available risk_type, risk_subtype, data_exposure_surface, and operation_stage enumerations. Fields and values may expand as the product evolves. The console display and actual returned results prevail.

Note

All example values in this topic are masked, synthesized, or documentary placeholders used to illustrate field formats and risk semantics. They do not represent real user data or constitute complete detection conditions. Sensitive values in actual events may be masked, truncated, or summarized by the collection pipeline.

incident-event represents high-fidelity security events that have undergone rule correlation, filtering, or promotion. Each event typically has clear evidence locations, risk subjects, severity, and investigation entry points, making it suitable as input for risk audit details, notification configuration, automated remediation, and secondary development. It does not store disposition status and is not equivalent to a ticket or notification object. If disposition workflows are needed, aggregate and manage status based on these fields in an upstream system.

Field descriptions

Field	Type	Description
`incident_event_id`	string	Primary key of the high-fidelity security event. Generated by deterministic rules and suitable for deduplication, idempotent writes, and external system references.
`event_name`	string	High-fidelity event name, always in the format `incident.<risk_type>`. Source event types, data exposure surfaces, and operation stages are not encoded in this field.
`source_scope`	enum	Data source scope. Valid values: `application` or `runtime`, which indicate application-side audit and runtime audit, respectively.
`time_unix_nano`	int64	Event generation or evidence chain merge time in nanoseconds. Page queries still use log time windows for filtering. This field is primarily for semantic event time and evidence retrieval.
`service_name`	string	Application or service name. May be empty or use a placeholder when the value cannot be determined.
`agent_type`	string	Agent type, such as qoder, cursor, or claude-code.
`user`	string	Flattened query column for the user entity, taken preferentially from `user.id`. Suitable for filtering and grouping by user.
`host`	string	Flattened query column for the host entity, taken preferentially from `host.name`. When `host.name` is empty or missing, `__tag__:__hostname__` is used for compatibility.
`source_ip`	string	Flattened query column for the Agent host IP entity, taken preferentially from `host.ip`. When `host.ip` is empty or missing, `__source__` is used for compatibility. This field does not represent a network peer or outbound target.
`severity`	enum	Risk severity, indicating the potential impact if the risk materializes. Values from highest to lowest: `critical`, `high`, `medium`, and `low`, displayed on the page as Critical, High, Medium, and Low.
`confidence`	number	The degree of certainty the system has about the current risk judgment, ranging from 0 to 1. The value is determined by the corresponding detection rule and the current evidence.
`risk_type`	string	Risk type, corresponding to the main category in the product. This is the most commonly used classification field for configuring risk filters, notification rules, and secondary analysis.
`risk_subtype`	string	Risk subtype, identifying the specific risk fact under its `risk_type`. For sensitive data exposure events, it typically represents the sensitive data type. For sensitive file mutation events, it typically represents the file type and action.
`data_exposure_surface`	enum	The surface where sensitive data is exposed. Can be empty. Valid values: `agent_input`, `model_input`, `model_output`, `tool_input`, `tool_output`, `agent_output`, or `network_egress`. This field does not indicate whether the operation has been executed.
`operation_stage`	enum	The operation stage that the current evidence can confirm. Can be empty. Valid values: `intent`, `invoked`, `executed`, or `completed`. Historical empty values are displayed as "Stage not recorded". This field does not indicate whether the operation succeeded or failed.
`risk_signature`	string	Precise risk signature for identifying a specific risk instance. Suitable for per-risk deduplication, detail aggregation, and reproduction localization.
`risk_family_key`	string	Same-class risk aggregation key for merging similar risks in the display. Suitable for risk queues, trend analysis, and impact assessment.
`reason`	string	Risk determination reason or evidence summary. Can be empty. Events generated by models or other semantic analysis typically use this field to explain why the risk is established.
`evidence_security_event_ids`	string[]	Array of low-fidelity security finding IDs that support this event.
`evidence_event_ids`	string[]	Array of raw activity event IDs that support this event.
`evidence_session_id`	string	The evidence Session to which the event belongs. `incident-event` does not store a top-level `session_id`. Use this field for Session drill-down and statistics.
`evidence_subject_type`	string	Evidence subject type, describing the primary subject category associated with the event.
`evidence_subject_value`	string	Evidence subject value, used together with `evidence_subject_type`.
`evidence_subject_key`	string	Stable key for the evidence subject, used for more reliable subject correlation.
`evidence_values`	object[]	Structured evidence value array, such as matched sensitive types, masked values, file paths, command fragments, or outbound targets.
`entities`	object[]	Key risk entity snapshot, such as application, user, host, Agent host IP, tool, domain, destination IP, Secret, PII, file path, or command entities. Multi-signal promoted events should merge all key entities.
`detector_name`	string	The name of the detector or service that generated this event.
`detector_version`	string	Detector or service version.

user, host, and source_ip are suitable for direct filtering and grouping. For multi-entity relationships and precise entity lookups, use entities. These flattened columns can be empty when the corresponding values cannot be extracted from historical records.

Common field examples

Field	Example value	Description
`incident_event_id`	`incident_application_7f3a...`	The specific format is generated by the system. External systems only need to use it as a stable ID.
`source_scope`	`application`, `runtime`	Indicates whether the event comes from application-side audit or runtime audit.
`user` / `host` / `source_ip`	`alice` / `demo-host` / `10.0.1.42`	Represent the user, the host running the Agent, and the Agent host IP, respectively. Can be used directly for common filtering and grouping.
`risk_type`	`sensitive_data_exposure`, `destructive_action`	Indicates the risk action or high-fidelity event type.
`risk_subtype`	`secret.cloud_access_key`, `ssh_private_key.delete`, `resource_delete`	Indicates the sensitive data type, the sensitive file type and action, or another specific risk fact.
`severity`	`critical`, `high`, `medium`, `low`	Used for disposition priority. Do not use it independently of `risk_type`.
`confidence`	`0.90`	Indicates the maturity of the event evidence chain and the certainty of the rule.
`data_exposure_surface`	`network_egress`	Indicates that sensitive data and an explicit external target appear together in a single tool operation. It does not indicate that the data was sent successfully.
`operation_stage`	`intent`, `invoked`, `executed`, `completed`	Indicates the operation stage that the current evidence can confirm.
`evidence_session_id`	`sess-20240630-demo`	Used to navigate to Session browsing or retrieve context.
`evidence_values`	`[{"field":"gen_ai.tool.call.arguments","value":"[ACCESSKEY_MASKED]","label":"secret.cloud_access_key","role":"sensitive_data"}]`	Used to display specific evidence. The values in the example are masking markers. Actual values may be masked according to the collection policy.
`entities`	`[{"type":"domain","value":"example.com"},{"type":"secret","value":"secret.cloud_access_key"}]`	Used to represent key risk subjects, such as outbound destinations, sensitive data, file paths, tools, or hosts.

Available risk_type values

The following table lists the risk_type values in the current risk type catalog. Different detection rules, data sources, and switch configurations produce different results. A type that appears in the catalog does not necessarily generate incident-event events in every data scope.

risk_type	Display name	Description
`prompt_injection`	Prompt injection	Untrusted content attempts to override instructions, hijack roles, jailbreak, or induce unauthorized actions.
`model_refusal`	Model refusal	The model explicitly refuses a high-risk request or sensitive content.
`sensitive_data_exposure`	Sensitive data exposure	Sensitive data appears at the model, tool, Agent, or network egress boundary.
`unexpected_code_execution`	Unexpected code execution	Code is downloaded, decoded, injected, or executed without authorization.
`destructive_action`	Destructive action	Important resources are deleted, overwritten, or terminated without authorization.
`privilege_escalation`	Privilege escalation	Local or cloud privileges are expanded without authorization.
`persistence`	Persistence	Long-term execution capability that resumes on restart, logon, or schedule is established without authorization.
`defense_impairment`	Defense impairment	Access controls, security tools, auditing, or network protection are weakened without authorization.
`credential_access`	Credential access	Credential stores, environment credentials, cloud identity credentials, or private keys are read without authorization.
`remote_control_channel`	Remote control channel	An interactive remote control or C2 channel is established without authorization.
`unauthorized_network_exposure`	Unauthorized network exposure	Local services, ports, or network paths are exposed to a broader trust boundary without authorization.
`agent_misrepresentation`	Agent result misrepresentation	The Agent's statement about the completion, failure, or current state of an important action contradicts the objective result.
`system_discovery`	System discovery	Discovery of identity, environment, or credential storage locations.
`outbound_action`	Outbound action	External access, message sending, or data transfer actions.
`sensitive_file_mutation`	Sensitive file mutation	A high-value sensitive file is created, edited, or deleted.

The display name is the name used in risk details, filters, and attribution cards. Metric cards may use a more specific descriptive name based on data_exposure_surface for the same risk_type.

Sensitive data risk subtypes (risk_subtype)

For sensitive_data_exposure, risk_subtype typically represents the matched sensitive data type. Users can configure different disposition priorities based on this field. For example, direct authentication credentials and highly sensitive identity information typically have higher priority, while ordinary email addresses or IP addresses typically require context-based assessment.

risk_subtype	Display name	Type	Example pattern	Description
`secret.openai_key`	OpenAI Key	Secret	`sk-...`	OpenAI Key or similar model service key.
`secret.github_token`	GitHub Token	Secret	`ghp_...`	GitHub Token or similar code hosting access credential.
`secret.auth_header`	Authentication header	Secret	`Authorization: Bearer ...`	Bearer Token, Authorization Header, or other direct authentication information.
`secret.private_key`	Private key	Secret	`[PRIVATEKEY_MASKED]`	Private key content.
`secret.ssh_private_key`	SSH private key	Secret	OpenSSH private key path or masked private key content	SSH private key.
`secret.pki_private_key`	PKI private key	Secret	`/etc/ssl/private/server.key` or masked private key content	PKI private key or certificate private key.
`secret.env_secret`	Environment variable secret	Secret	`.env` containing `TOKEN=value`	Secret or sensitive configuration in environment variables.
`secret.connection_string`	Connection string	Secret	`[DATABASEURL_MASKED]`, `postgresql://user:pass@example.com:5432/app`	Database, Redis, or other service connection string with password.
`secret.alibaba_cloud_ak`	Alibaba Cloud credential	Secret	`LTAI...`	Alibaba Cloud AccessKey.
`secret.aws_key`	AWS Access Key	Secret	`AKIA...`	AWS Access Key.
`secret.cloud_access_key`	Cloud service credential	Secret	`[ACCESSKEY_MASKED]`	Cloud provider access key, including collector-identified masked cloud keys.
`secret.generic_api_key`	Generic API key	Secret	`[APIKEY_MASKED]`, long random token	Generic key with API Key characteristics.
`pii.id_card`	ID card number	PII	Masked ID card number or validated identity identifier	ID card number or similar highly sensitive identity identifier.
`pii.credit_card`	Bank card number	PII	Masked bank card number or validated financial card number	Bank card number, credit card number, or similar financial sensitive information.
`pii.phone`	Mobile phone number	PII	`13800138000`	Mobile phone number.
`pii.landline_phone`	Landline phone	PII	Landline phone number pattern	Landline phone number.
`pii.email`	Email address	PII	`alice@example.com`	Email address.
`pii.ip_address`	IP address	PII	`203.0.113.10`	IP address. Typically requires context-based assessment with internal/external network classification.

The system determines the severity of sensitive data events based on both risk_subtype and the data exposure surface. operation_stage is not involved in general severity conversion. When the same sensitive type appears at different surfaces, assess it based on actual evidence and disposition priority.

Sensitive data exposure surfaces

data_exposure_surface only describes where sensitive data is exposed, not the operation progress or whether the operation succeeded. Operation progress is represented independently by operation_stage.

data_exposure_surface	Display name	Description
`agent_input`	Agent input	Sensitive data appears in the input received by the Agent.
`model_input`	Model input	Sensitive data enters the model request context.
`model_output`	Model output	Sensitive data appears in the model response.
`tool_input`	Tool input	Sensitive data appears in tool call arguments.
`tool_output`	Tool output	Sensitive data appears in tool return results.
`agent_output`	Agent output	Sensitive data appears in the final output of the Agent.
`network_egress`	Network egress	Sensitive data and an explicit external target appear together in a single tool operation. This value does not by itself indicate that the data was sent successfully.

Sensitive file mutation risk subtypes (risk_subtype)

For sensitive_file_mutation, risk_subtype typically follows the <file_type>.<action> pattern, where action is create, edit, or delete, displayed on the page as Create, Edit, and Delete. The following table lists the subtypes recommended for focused attention in current high-value sensitive file mutation events.

risk_subtype pattern	Group	Description	Risk focus
`ssh_private_key.create` / `ssh_private_key.edit` / `ssh_private_key.delete`	SSH private key	SSH private key created, edited, or deleted.	May affect host login credentials, automated deployment credentials, or lateral access capabilities.
`ssh_authorized_keys.create` / `ssh_authorized_keys.edit` / `ssh_authorized_keys.delete`	SSH Authorized Keys	SSH authorized_keys created, edited, or deleted.	May add or remove host login entry points. Requires authorization confirmation.
`cloud_credentials.create` / `cloud_credentials.edit` / `cloud_credentials.delete`	Cloud credentials	Cloud provider credential file created, edited, or deleted.	May affect cloud resource access permissions or credential exposure surface.
`k8s_config.create` / `k8s_config.edit` / `k8s_config.delete`	Kubernetes configuration	Kubernetes configuration file created, edited, or deleted.	May affect cluster access permissions, context switching, and service account usage.
`env_secret.create` / `env_secret.edit` / `env_secret.delete`	Environment variables	Environment secret file created, edited, or deleted.	May change application runtime keys, tokens, connection strings, or third-party service credentials.
`pki_private_key.create` / `pki_private_key.edit` / `pki_private_key.delete`	PKI private key	PKI private key created, edited, or deleted.	May affect certificate issuance, TLS identity, and internal trust chain.

Public keys, certificate materials, generalized configuration files, or low-confidence sensitive paths may still appear as low-fidelity findings or contextual evidence, but may not be promoted to high-fidelity sensitive file mutation events. When assessing, prioritize file type, action type, tool call context, and whether the change aligns with the user's authorized goal.

Advanced risk subtypes (risk_subtype)

For advanced risks, risk_subtype represents the specific risk fact under its risk_type. When computing statistics, filtering, or configuring notifications across multiple risk categories, always use the complete risk_type + risk_subtype combination.

risk_type	Typical risk_subtype	Description
`prompt_injection`	`injection_pattern`, `role_hijack`, or `indirect_injection`	Instruction override, role hijacking, or indirect prompt injection.
`unexpected_code_execution`	`remote_download_execute`, `obfuscated_script_execution`, or `runtime_injection`	Remote download and execution, obfuscated script execution, or runtime injection.
`destructive_action`	`file_delete`, `disk_overwrite`, `resource_delete`, or `service_termination`	File deletion, disk overwrite, resource deletion, or service termination.
`privilege_escalation`	`setuid_escalation`, `root_ownership_change`, or `cloud_role_escalation`	Local or cloud privileges are unexpectedly expanded.
`persistence`	`scheduled_task`, `system_service`, `startup_item`, or `authorized_key`	Persistence established through scheduled tasks, system services, startup items, or authorized keys.
`defense_impairment`	`access_control_weakening`, `security_tool_tampering`, `audit_logging_disable`, or `firewall_weakening`	Access controls, security tools, audit logging, or firewalls are weakened.
`credential_access`	`credential_store_read`, `environment_credential_read`, `cloud_identity_credential_read`, or `private_key_read`	Unauthorized reading of credential stores, environment credentials, cloud identity credentials, or private keys.
`remote_control_channel`	`reverse_shell`, `bind_shell`, or `c2_channel`	Reverse shell, bind shell, or C2 channel.
`unauthorized_network_exposure`	`cloud_tunnel`, `reverse_tunnel`, `public_listener`, or `port_publish`	Unauthorized network exposure caused by tunnels, public listeners, or port publishing.
`agent_misrepresentation`	`false_completion`, `failure_concealment`, or `state_fabrication`	False completion claims, failure concealment, or state fabrication.

A single session may produce multiple events with different risk types or risk subtypes. reason explains the determination reason for the current event. Severity is determined by the actual impact and cannot be copied directly from the severity of a preliminary candidate.

Field usage recommendations

When configuring risk notifications or secondary analysis, use risk_type first to distinguish risk categories, then use risk_subtype to distinguish sensitive types or file actions. For deduplication and aggregation, use risk_signature for individual risk details, risk_family_key for same-class risk queues, and evidence_session_id and evidence_event_ids for evidence replay.

Do not determine final priority based solely on risk_subtype. For example, an email address appearing in model input and an email address bound to an external target in the same tool operation may have different disposition priorities. Similarly, an SSH private key being read and an SSH private key file being modified represent risks of different natures. A more robust approach is to combine risk_type, data_exposure_surface, operation_stage, severity, confidence, entities, and Session context.

severity, confidence, and operation_stage answer different questions: severity indicates the impact and disposition priority if the risk materializes, confidence indicates how certain the system is about the risk judgment, and operation stage indicates the execution progress that the current evidence can confirm. There is no general conversion rule among the three. You cannot infer the execution stage from severity, nor automatically lower the severity because the stage is intent.

For network_egress, the page also displays the operation stage: intent indicates outbound intent, invoked indicates that an outbound call has been initiated, executed indicates that the outbound operation has actually been executed, and completed indicates that the tool return result has been received. When operation_stage is empty, "Stage not recorded" is displayed. If the sensitive content comes from a tool return result, tool_output + completed is used. Do not interpret the returned content as data that was previously sent. executed and completed do not indicate that the operation succeeded. To determine the operation result, check the status, exit code, or error message in the tool return result.

Event examples

The following examples illustrate field combinations. Field names and enum values can be used directly as integration references. IDs, timestamps, evidence values, and entity values are synthesized or masked content.

Sensitive data outbound event

{
  "incident_event_id": "incident_application_demo_outbound_001",
  "event_name": "incident.sensitive_data_exposure",
  "source_scope": "application",
  "service_name": "agent-demo-service",
  "agent_type": "qoder",
  "user": "alice",
  "host": "demo-host",
  "source_ip": "10.0.1.42",
  "severity": "high",
  "confidence": 0.9,
  "risk_type": "sensitive_data_exposure",
  "risk_subtype": "secret.cloud_access_key",
  "data_exposure_surface": "network_egress",
  "operation_stage": "completed",
  "evidence_session_id": "sess-demo-001",
  "evidence_values": [
    {
      "field": "gen_ai.tool.call.arguments",
      "value": "[ACCESSKEY_MASKED]",
      "label": "secret.cloud_access_key",
      "role": "sensitive_data"
    },
    {
      "field": "gen_ai.tool.call.arguments",
      "value": "https://example.com/upload",
      "label": "example.com",
      "role": "outbound_target"
    }
  ],
  "entities": [
    { "type": "tool", "value": "WebFetch" },
    { "type": "domain", "value": "example.com" },
    { "type": "secret", "value": "secret.cloud_access_key" }
  ]
}

This event indicates that a masked cloud key and an external upload target appeared together in a single tool call, and the system has received the matching tool return result. External systems should combine data_exposure_surface and operation_stage to determine the outbound path and execution progress, use risk_subtype to determine the sensitive data type involved, and use entities to extract the external target and sensitive entities. To confirm whether the operation succeeded, further check the structured status in the tool return result.

Sensitive file mutation event

{
  "incident_event_id": "incident_application_demo_file_001",
  "event_name": "incident.sensitive_file_mutation",
  "source_scope": "application",
  "service_name": "agent-demo-service",
  "agent_type": "qoder",
  "severity": "high",
  "confidence": 0.86,
  "risk_type": "sensitive_file_mutation",
  "risk_subtype": "ssh_private_key.delete",
  "evidence_session_id": "sess-demo-002",
  "evidence_values": [
    {
      "field": "gen_ai.tool.call.arguments",
      "value": "/home/alice/.ssh/id_ed25519",
      "label": "ssh_private_key.delete",
      "role": "file_path"
    }
  ],
  "entities": [
    { "type": "tool", "value": "Bash" },
    { "type": "file_path", "value": "/home/alice/.ssh/id_ed25519" },
    { "type": "host", "value": "demo-host" }
  ]
}

This event indicates that the Agent performed a delete action on a stable sensitive file. During investigation, first confirm whether the deletion aligns with the authorized goal of the task and whether it affects host login credentials or automated deployment credentials.

Destructive action event

{
  "incident_event_id": "incident_application_demo_destructive_001",
  "event_name": "incident.destructive_action",
  "source_scope": "application",
  "service_name": "agent-demo-service",
  "agent_type": "qoder",
  "severity": "high",
  "confidence": 0.8,
  "risk_type": "destructive_action",
  "risk_subtype": "resource_delete",
  "reason": "The user authorized operations only on the specified test instance, but the Agent actually performed a batch deletion on additional instances.",
  "evidence_session_id": "sess-demo-003",
  "evidence_event_ids": ["evt-demo-destructive-001"],
  "evidence_security_event_ids": ["security-demo-destructive-001"],
  "entities": [
    { "type": "tool", "value": "Bash" },
    { "type": "user", "value": "alice" },
    { "type": "host", "value": "demo-host" },
    { "type": "source_ip", "value": "10.0.1.42" }
  ]
}

This event indicates that the system, by combining the user authorization, the actual operation, and the execution result, confirmed that the Agent deleted resources beyond the scope of the user's authorization. External systems can use risk_type to identify destructive actions, use risk_subtype to distinguish specific risk facts such as resource deletion, and review the full context through evidence events and Session replay.