Incidences & Audit
Incidences lists everything the agent caught on your developers' devices. The audit log records every change to the policies that decide what it catches.
Incidences
Open Agentic runtime → Incidences.
| Card | Description |
|---|---|
| Open incidences | Incidences not yet resolved |
| Critical | Open incidences of critical severity |
| High | Open incidences of high severity |
| Resolved last 24h | Incidences closed in the last day |
Filter by Severity, Family (credentials, prompt injection, dangerous tools, MCP, skills, models...), Status and Source.
Click an incidence to see its detail: the device and member, the coding agent, the detection family and the redacted evidence. Prompts never leave the device, so the console only receives redacted metadata.
Act on an Incidence
| Action | Effect |
|---|---|
| Resolve | Closes the incidence, with a note |
| Detection feedback | Reports a wrong detection, so the detector improves |
| Block | Adds what caused it (an MCP server, a skill, a model) to a block list, at the scope you choose |
Select several incidences to act on them in bulk.
Report a Missed Injection
Click Report a missed injection when a prompt injection reached a coding agent without being caught. Your report trains the detector.
Audit Log
Agentic runtime → Audit log records every policy change across organization, team, member and device scopes, and every custom rule change. It is append-only.
| Column | Description |
|---|---|
| When | Time of the change |
| Actor | Who made it |
| Scope | Organization, team, member or device |
| Field | The setting that changed |
| Action | What happened |
| Change | The value before and after |
Filter by Scope and Field.