Audit Management
Audit Management centralizes risk detection configuration and monitoring between the Ingestion Center and Risk Audit. Configure application and runtime detection settings, monitor detection run status, and review ingestion data for AI applications and runtimes from this page.
Page overview
Audit Management sits between the Ingestion Center and Risk Audit in the audit workflow. Data is onboarded and collected in the Ingestion Center, detection is configured and monitored in Audit Management, and risk events are analyzed in Risk Audit.
From the Audit Management page, you can:
Configure risk detection — Manage application and runtime risk detection switches and semantic detection options.
View detection run status — Monitor the status of detection tasks and the number of high-risk events in the last 24 hours.
View AI application ingestion data — Review Agent type, application name, latest data time, and 24-hour event volume trends.
View AI runtime ingestion data — Review host, Agent type, latest data time, and 24-hour event volume trends.
Onboarding, collection rules, and runtime detection configuration are all managed in the Ingestion Center. Complete application log ingestion in the Ingestion Center before data appears on this page.
Detection configuration
The Detection Configuration card at the top of the page shows the current configuration summary by default.
To edit detection settings
Click Edit on the Detection Configuration card.
Toggle the detection switches and semantic detection options as needed. The following tables describe each option.
Click Save Configuration to submit all changes at once.
If the changes disable application risk detection, runtime risk detection, or dangerous command recognition, the page lists the capabilities to be disabled and requests confirmation. Confirm to apply the changes.
Detection switches
| Configuration | Description |
| Application risk detection | Controls application-side security-event and incident-event risk processing. |
| Runtime risk detection | Controls runtime security-event and incident-event risk processing. |
Application and runtime risk detection can be enabled independently. The detection switch only affects risk processing and does not affect Session browsing, Token analysis, or behavior analysis audit fact queries.
Semantic detection options
| Configuration | Description |
| Basic detection | Includes sensitive information and sensitive file checks. Always enabled. |
| Dangerous command recognition | Identifies high-risk commands executed by the Agent. |
| Prompt injection | Coming soon. Currently not selectable. |
After you disable detection, risk processing is paused. Existing risk data and raw logs are not deleted.
Detection run status
When at least one of application or runtime risk detection is enabled, the detection run status card appears at the top of the page with the following statuses:
Running normally — All detection tasks within the enabled scope are available, and the most recent task instances show no anomalies.
Processing delay — The most recent three task instances have been running continuously. If this status persists, submit a ticket.
Running unstable — Expected tasks are missing or not enabled, or failures appear in recent task instances. If this status persists, submit a ticket.
The status card also shows the number of high-risk events in the last 24 hours and provides a link to Risk Audit for further analysis. Detection tasks are managed automatically — no manual task management is required on this page.
When neither application nor runtime risk detection is enabled, the detection run status card is not displayed.
AI application ingestion data
After you complete application log ingestion in the Ingestion Center and events are generated, applications automatically appear in the list. The list supports filtering by Agent type and application name.
| Field | Description |
| Agent type | The type identifier of the Agent. |
| Agent application name | The application name configured during ingestion. |
| Latest data time | The time of the most recently received application event. |
| 24-hour event volume trend | Event volume trend over the most recent 24 hours. |
| Actions | Click View to open Session browsing with Agent type and application filters applied. |
AI runtime ingestion data
Runtime collection configuration is not available on the Audit Management page. Detection rules, allowlists/blocklists, and collection configuration are managed in the Ingestion Center.
| Field | Description |
| Host | The host or instance with runtime collection enabled. |
| Agent type | The Agent type identified by the runtime. |
| Latest data time | The time of the most recently received runtime event. |
| 24-hour event volume trend | Event volume trend over the most recent 24 hours. |
| Actions | Click View to open Session browsing with the host filter applied. |
When runtime risk detection is not enabled, raw runtime events can still be collected and browsed, but no new runtime risk processing results are generated.
FAQ
Q: Do application risk detection and runtime risk detection need to be enabled simultaneously?
No. The two can be used independently.
Q: Is historical data deleted after risk detection is disabled?
No. After detection is disabled, risk processing is paused. Existing risk data and raw logs are not deleted.
Q: What should I do when detection status is abnormal?
The Audit Management page displays detection status in read-only mode and does not provide task repair operations. If the status shows Processing delay or Running unstable, submit a ticket.