Incidence Detail
The incidence detail opens as a drawer when you click a row in Incidences. It explains what the gateway decided and why, what was sent, who sent it, and how the request moved through every stage of the pipeline.
Header
Click to expand
The top of the drawer shows the verdict, the operation, the HTTP status, the detection and the triage status.
The header buttons let you:
- Move to the previous or next incidence of the current page.
- Copy the incidence link (the URL with
?trace=), which opens this same drawer for anyone in your organization. - Copy the trace to the clipboard.
Why This Was Blocked
For blocked and masked requests, a box names the detector that acted and the violation it reported, for example prompt-guard triggered Prompt injection.
Below it you see what was inspected:
- For LLM traffic, the prompt and the response.
- For MCP traffic, the tool call arguments or the tool result.
Content is only shown when the route stores it. See the Privacy settings of Routes.
Threat References
Chips map the detection to industry taxonomies:
| Chip | Example | Reference |
|---|---|---|
| OWASP LLM | LLM01 | OWASP Top 10 for LLM Applications |
| MITRE ATLAS | AML.T0054 | MITRE ATLAS technique |
| CWE | CWE-1427 | Common Weakness Enumeration |
You can filter Incidences by any of them.
Request Metadata
| Field | Description |
|---|---|
| Route / Policy | The route that received the request and the policy that judged it |
| Operation | For MCP traffic, the JSON-RPC method (tools/call, tools/list...) |
| Alias called / Tool | The tool name the client called on the route, and the real tool behind it |
| Tool origin / Upstream | Whether the tool is your own endpoint or imported from an MCP server, and that server's URL |
| Result inspection | Whether the tool result was inspected |
| Consumer | The consumer credential that sent it |
| Provider / Model | The provider and model for LLM traffic |
| Route profile | The route type |
| Direction | Input (the request) or output (the response) |
| Latency / Guard overhead / Upstream time | Total time, the gateway's share, and the provider or tool's share. A blocked request shows not forwarded |
| Tokens | Tokens used, for LLM traffic |
| End user | The x-user-id your application sent |
| Client | The client IP, masked to a /24, with its network |
| Request size | Request size in characters |
| Trace ID / Time | The check ID and timestamp |
Findings
A table lists every finding of every detector that ran: detector, finding, action taken, confidence and references.
Full Trace
Full trace breaks the request into its pipeline stages, with the time spent in each:
Click to expand
| Stage | Shows |
|---|---|
| Request | What the client sent |
| Gateway decision | The decision with the alias, tool origin, detector, violation and raw scores |
| Upstream call | The call to the provider or tool, or Not forwarded when the request was blocked |
| Result inspection | How the response or tool result was inspected |
| Response to the client | What the client received |
Detection Feedback, Triage and Evidence
The lower part of the drawer is where you act on the incidence: report a wrong detection, triage it and export evidence. See Triage & Feedback.
Next Steps
Triage & Feedback
Assign, resolve and report detection mistakes
Policies
Tune the detector that fired