Activity & alerts
Decide how much prompt content Sentinel collects, then search activity across devices, see who is running agents, and review model-assessed alerts.
Choose what to capture
Set the capture mode under Policy → Collection → Prompt capture.
| Mode | What is stored |
|---|---|
| Full prompt | Direct user prompts, up to 64 KiB each. This is the default. Network capture is configured separately. |
| Redacted preview | A bounded excerpt with locally detected sensitive values removed. Network bodies are not redacted. |
| Metadata only | No prompt text and no captured network headers or bodies. Usage, timing, destinations, file and process metadata, and local finding counts remain. |
Metadata only overrides network capture, including when gateway routing starts the guard. The control plane also applies it before storing new events, so content sent by a collector that has not applied the mode yet is not stored.
Per-user collectors use the prompt_capture setting in their local configuration. Privileged services receive the workspace policy and device overrides.
The activity feed
Security → Events shows events across all reporting devices, grouped by day, with captured prompt previews you can expand. Filter by content, event type, model, user, device, harness, session, signal, and time range. Totals for events, sessions, devices, tokens, and findings cover every match, not just the visible page.
- Live tail refreshes the newest page every five seconds. Older pages and custom ranges pause it.
- Search works on prompt data that was already captured.
- User search matches reported device usernames and current manual assignments. It does not establish who performed an operation.
- Downloads contain the current page and its filter scope.
Who is running agents
Devices → By person lists who is running coding agents, live sessions first. Open a person for a live tree of their agents and subagents with model, tokens, and age.
Tool names are opt-in. Add this to the collector configuration to include them:
{ "tool_names": true }A person is attributed through the device account's verified exo login or a manual assignment in the device inventory. Workstation policy decisions carry device and, where available, run attribution.
Unknown agents
Sentinel reads activity natively for the harnesses it supports. Any other process with an open connection to a known LLM API host is reported as an unknown:<process name> session for as long as it runs. Tokens, model, and prompts are not available for these sessions; the console shows the providers contacted and the last two segments of the working directory. Browsers, container and VM network relays, and known harnesses are excluded.
Turn this off in the collector or service configuration:
{ "unknown_agents": "off" }Security alerts
Security → Alerts shows model assessments of captured prompts and of recorded policy decisions. An assessment with a malicious probability above 0.5 creates an alert for review.
- Alerts are independent of enforcement. Blocked attempts can create alerts, and so can monitored or unblocked activity. A block alone does not establish malicious intent.
- An assessment never changes the enforcement decision.
- Events with no reported enforcement outcome show Outcome unknown. Not blocked does not confirm that execution completed.
- Only new activity is assessed. There is no backfill, and content that was not captured cannot be assessed, so metadata-only mode produces no prompt assessments.
- Up to 32 KiB of content is assessed. The captured content is cleared once classification completes; the reason, probability, model, and outcome remain.
Assessments use your workspace's default AI provider and are metered like other model usage. Viewing alerts needs the alerts:read permission.