Audit Facts
Audit Facts is the raw behavior browsing and analysis entry point of the Audit module. It includes three tabs: Session Browsing, Token Analysis, and Behavior Analysis. This topic describes the features and usage of the Audit Facts page.
Page overview
Audit Facts directly describes raw sessions, model requests/responses, tool calls, tool results, and runtime behaviors reported by the Agent. It does not depend on the risk audit switch being enabled. When the risk audit switch is off, Risk Audit and Entity Investigation may only display historical risk data, but Audit Facts remains available for verifying ingestion results, troubleshooting context, and analyzing Token/behavior trends.
The top of the page provides unified filters: data scope, Agent type, and query time range. The data scope currently provides AI Application Audit and AI Runtime Audit. The default query time range is the last 7 days.
Page structure
The Audit Facts page contains three tabs:
Tab | Description |
Session Browsing | Filter sessions by host, user, Agent application, source IP, Tool, Session ID, and more. View context timelines. |
Token Analysis | Analyze input tokens, output tokens, total tokens, model distribution, time trends, and high-consumption sessions. |
Behavior Analysis | View Agent activity, model requests, tool calls, command execution, external interactions, errors, and Session rankings from a neutral behavior perspective. |
Session Browsing
Session Browsing uses a left-right split layout:
Left panel: Session list showing sessions that match filter conditions.
Right panel: Full context details of the selected Session.
Top-level statistics
The top of the page displays overall statistics for the current filter scope:
Metric | Description |
Sessions | Total number of matching sessions |
Events | Total raw event count |
Turns | Number of user-Agent interaction rounds |
Steps | Number of Agent execution steps |
LLM Requests | Number of LLM model requests |
Input Tokens | Total model input token count |
Output Tokens | Total model output token count |
LLM Responses | Number of LLM model responses |
Tool Calls / Results | Number of tool calls and return results |
Filter conditions
Session Browsing supports the following filter dimensions:
Filter | Description |
Time range | Located in the top-level unified filter. Default is the last 7 days. |
Agent type | Located in the top-level unified filter. |
Host | Filter by Agent runtime host. |
User | Filter by user dimension. |
Agent application | Filter by application name. |
Source IP | Filter by collection source IP. |
Tool | Filter by tools used. |
Session ID | Filter or locate a session by specific Session ID. |
Filter inputs support prefix queries and return matching values with session counts.
Session list
The Session list displays summary information for matching sessions:
Field | Description |
Session ID | Unique session identifier |
Tool summary | Main tools used in the session |
Host / Agent application | Runtime host and application name |
User / Agent type | User identifier and Agent type |
Source IP | Collection source IP |
Events | Total raw event count |
Turns | Interaction round count |
Steps | Execution step count |
Req / Resp | LLM request count / response count |
Tool Calls / Results | Tool call count / result count |
Last active | Timestamp of the most recent event |
The list is paginated. Click a row to display the Session context in the right panel.
Session context details
After selecting a Session, the right panel displays the complete event timeline for that Session.
Event types
The timeline displays the following raw event types:
Event type | Label | Description |
Other event | other | Session-level metadata events |
LLM Request | Request | Request sent to the model, including messages input |
LLM Response | Response | Response returned by the model, including assistant output |
Tool Call | tool call | Tool invocation initiated by the Agent, including tool name and parameters |
Tool Result | tool result | Return result from tool execution |
Event information
Each event displays the following information:
Event ID: Globally unique identifier.
Turn / Step: The interaction round and step number the event belongs to.
Timestamp: The precise time the event occurred.
Content summary: Key content displayed based on event type (user input, model output, tool parameters and results, and more).
Token Analysis
Token Analysis observes model call costs and context consumption, answering: "Which models, applications, or sessions consumed the most tokens, and is consumption concentrated in a few long sessions or anomalous requests?"
Token Analysis typically includes:
Module | Description |
Token overview | Displays input tokens, output tokens, and total tokens. |
Model distribution and trends | Displays token consumption by model and time trends. |
Session ranking | Displays high-consumption sessions with navigation to Session Browsing for context review. |
Token bucket distribution | Observes long context and anomalous consumption by Turn or Session token consumption ranges. |
Token Analysis is an audit facts view and does not represent a confirmed security risk. If anomalous consumption is detected, combine Session Browsing and Behavior Analysis to confirm whether loop calls, repeated tool failures, excessively long context, or anomalous model requests exist.
Behavior Analysis
Behavior Analysis observes Agent activity from a neutral behavioral perspective. It does not directly equate to risk detection results. It answers: "Which applications are most active, which tools are frequently called, are there large volumes of command execution, external interactions, or tool errors?"
Behavior Analysis typically includes:
Module | Description |
Activity metrics | Displays active Agents, session count, model requests, total behavior volume, and other overviews. |
Tools and commands | Displays tool call, command execution, command families, and tool error statistics. |
External interactions | Displays external target, domain, or network interaction related behaviors. |
Session ranking and timeline | Locates sessions with anomalous behavior volumes and navigates to Session Browsing for context replay. |
Behavior Analysis helps users understand normal behavior baselines and can provide background for risk investigations. For example, when Risk Audit detects sensitive data exfiltration, Behavior Analysis can show whether the same application or host simultaneously exhibits anomalous external interactions or tool errors.
Cross-page navigation and context positioning
Audit Facts serves as the context viewing entry point for other audit pages. When you need to view raw sessions from Risk Audit, Entity Investigation, or Audit Management, navigate to Audit Facts and view the corresponding Session event timeline in Session Browsing.
When navigating from Risk Audit, use the Session information in risk details to return to the raw session and view model requests, model responses, tool calls, and tool results around the time of the risk. When navigating from Entity Investigation, view the session context where a specific entity appeared. When navigating from Audit Management, verify whether a specific application or host is producing audit data.
This capability supports investigation path continuity: you can navigate from risks, entities, or ingestion status back to raw audit facts. The Audit Facts page itself only provides browsing, filtering, and context viewing capabilities, without risk annotation or disposition functions.
Use case examples
Example 1: View raw context from a security event
View the details of a risk in Risk Audit.
Note or navigate to the associated Session of the risk.
In Session Browsing under Audit Facts, view the raw event timeline for that Session.
Combine model requests, model responses, tool calls, and tool results to understand the complete process around the security event.
Example 2: Investigate anomalous token consumption
In Token Analysis under Audit Facts, identify a Session with anomalously high consumption.
Navigate to Session Browsing, or use the Session ID filter to locate the Session.
Review LLM Request/Response events to check for excessively long context or repeated calls.
Combine tool call events to confirm whether loop calls or failure retries exist.
Example 3: Verify ingestion data completeness
On the Audit Facts page, filter by recent time range and target Agent type.
Review the top-level statistics in Session Browsing to confirm that Session count and Event count match expectations.
Open a specific Session to view the event timeline and confirm that Turns, Steps, Request/Response, and Tool Call/Result events are complete.
If events are missing or fields are incomplete, check the ingestion configuration and collection component status.