Investigate runtime activity

Open Runtime after a runtime integration has received events. Filter by event type, agent, origin and time range to focus a specific deployment or investigation.

Event types and origins

Event types include tool calls, model requests, agent activity and policy signals. Observed describes events received from instrumented senders. Heuristic signals are derived by ModelFence from received events, including its new-destination heuristic. A heuristic is not an independently verified incident.

Inspect an event

Open a row to review its occurrence and receipt times, agent, tool or model, destination, outcome, environment, source integration and available correlation fields. Trace and span IDs help you correlate the report with your own application telemetry.

If the inspector says attributes were dropped, check the instrumentation against the allow-list. ModelFence does not store unsupported prompt or completion content. Do not assume a missing attribute means the sender never generated it.

Follow a lead

Use the linked asset to review observed relationships and findings. Compare a reported destination with the repository’s configured endpoint and your organization’s approved services. Investigate differences in the source environment before accepting or resolving the associated finding.

Empty states

No runtime telemetry connected means no integration is available for this capability. Waiting for the first event means a source exists but activity has not been received. Neither state means there were no tool calls.

For the complete sender setup, authentication and JSON example, see Send runtime events.