Managed Agent Details

At the top of the page, you can see the agent's identity and current state, including its platform, owner, overall risk level, and Active or Deactivated status. From the same header, you can refresh the agent information or deactivate the agent when its use needs to be stopped. The tabs below the header organize the agent's security context into Agent Posture, Connections, Credentials, Users, Access Graph, Event Logs, and Usage.

Use these views together to move from the agent's current security state to the relationships, changes, and activity behind it.


Tab	What it helps you understand
Agent Posture	Security and posture issues affecting the agent.
Connections	MCP servers and other connections associated with the agent.
Credentials	Credentials associated with the agent's connections.
Users	Users associated with the agent.
Access Graph	How users, credentials, MCP servers, connections, and tools relate to the agent, including historical changes.
Event Logs	Historical activity and security events associated with the agent.
Usage	Token consumption, cost trends, and detailed usage records for the agent.

The screenshot clearly shows the agent name, platform, owner, risk indicator, Active status, Refresh, Deactivate/Activate, and all tabs.


Item	What it tells you
Agent name and platform	Identifies the selected managed agent and the platform on which it operates.
Owner	Shows the user associated with the agent.
Risk level	Shows the agent's current overall risk level: Low, Medium, High, or Critical.
Status	Shows whether the agent is currently Active or Deactivated.
Refresh	Refreshes the agent details shown on the page.
Activate / Deactivate	Controls whether the agent can continue to be used.

Activate or Deactivate an Agent

Use Deactivate when an agent should no longer be allowed to run. After the agent is deactivated, attempts to use that agent are blocked. Use Activate to restore the agent when access is approved again.

Agent Risk

Every managed agent has an overall risk level: Low, Medium, High, or Critical. The risk indicator next to the agent name opens Risk Breakdown, which shows the risk categories and the specific signals contributing to the agent's current risk.

Understand Risk Breakdown

Risk Breakdown groups the agent's risk into categories such as User Risk, Identity Risk, Access Risk, Posture Risk, and Data Risk when applicable. Each category shows its current risk level and the triggered findings that contributed to that category.

For example, an agent can have Low User Risk and Low Identity Risk, while Access Risk is High because of Tool Sprawl and Posture Risk is Critical because of unresolved posture findings or unsanctioned resources. The overall agent risk is calculated from the applicable categories using the organization's configured risk model.

Note: Risk scoring is configured centrally under Settings > Risk Configuration. Administrators can enable or disable risk signals and adjust their importance based on the organization's security priorities.


Risk area	Where to investigate
Posture Risk	Agent Posture
Access Risk	Access Graph and Connections
Identity Risk	Credentials
User Risk	Users

Agent Posture

The Agent Posture tab lists posture issues and security findings associated with the selected agent. Use this view to understand the security conditions affecting the agent and to prioritize issues that need investigation or remediation.


Field	Description
Posture Issue	The security or configuration issue identified for the agent.
Resource	The resource associated with the finding.
Risk Level	The severity assigned to the finding.
Status	Whether the finding is currently resolved or unresolved.
Resource Type	The type of resource associated with the finding, such as Agent, Credential, or MCP Server.
Compliance	Compliance frameworks associated with the posture issue.
Detected On	When the posture issue was detected.

Connections

The Connections tab shows the MCP servers and other integrations associated with the selected agent. Use it to understand the agent's connection footprint and how many tools are exposed through each connection.


Field	Description
Name	Name of the connected MCP server or integration.
Category	Connection category, such as MCP Server.
Tools	Number of tools exposed through the connection.
Status	Current status of the connection.

Credentials

The Credentials tab shows credentials associated with the agent's connections. This view helps security teams understand how the agent authenticates to connected resources and identify the credential types involved in those relationships.


Field	Description
Name	Name or representation of the credential.
Type	Authentication type, such as OAuth 2.0.
Source	The connection or resource from which the credential originates.
Expires	Credential expiration information when available.

Users

The Users tab lists the users associated with the selected agent. It provides identity and ownership context that can be used during governance, risk assessment, and investigation.

For each associated user, the page shows the user name, email address, and current status.

Access Graph

The Access Graph is a visual map of the relationships around the selected agent. It brings users, credentials, connections, MCP servers, tools, and other related resources into one view so investigators can understand how the agent is connected to enterprise resources without manually correlating separate inventory pages.


Resource	What it represents
Users	Users associated with the agent.
Credentials	Credentials associated with the agent's connections.
MCP Servers	MCP servers connected to the agent.
Tools	Tools exposed through connected MCP servers.
Connections	Other connections associated with the agent.
Sub-agents	Child agents spawned by the agent, when present.

When a group contains many related resources, the graph can collapse additional items into a +N more node to keep the view readable. The Users, Credentials, and Connections tabs provide the corresponding full lists.

Use the Access Graph for Investigation

The Access Graph is most useful when an investigator needs to understand both the agent and the relationships around it. It can help answer questions such as:

Who is associated with this agent?
Which MCP servers and other connections are associated with the agent?
Which credentials are involved in those connections?
Which tools are available through connected MCP servers?
Did the agent's access change before or during a security event?

Timeline

Select Show Timeline to add historical context to the Access Graph. The Timeline records snapshots when the agent's access relationships change. Selecting an entry reconstructs the graph for that point in time, allowing investigators to review a previous access state and identify what changed.

Changes represented in the Timeline can include MCP servers or tools being added or removed, credential or connection changes, users being associated or removed, and changes involving sub-agents when present.

Select a Time Range

Investigate changes over 24 hours, 7 days, 30 days, 90 days, or a Custom period. For Custom, select the required start and end dates. Use a focused range when investigating activity around a known security event or unexpected access change.

Timeline Playback

Select Play to reconstruct the Access Graph across the selected period from older snapshots to newer states. As playback progresses, the graph updates to show how relationships were added or removed. Pause playback to examine a particular state, or select an individual Timeline entry to jump directly to that snapshot.

Investigation and Access-Drift Analysis

Access Graph, Timeline, and Playback together provide both current and historical context for an agent's access. They are particularly useful for:


Use case	How it helps
Access-drift analysis	See how the agent's connections and reachable resources changed from an earlier state.
Incident investigation	Reconstruct the agent's access relationships around the time of a security event.
Change investigation	Determine when a user, credential, MCP server, connection, or tool became associated with or was removed from the agent.
Historical analysis	Review a previous access state instead of relying only on the agent's current relationships.

Use Event Logs for the corresponding activity records during the same period.

Event Logs

The Event Logs tab provides a historical view of activity for the selected agent. It combines an interactive activity timeline with the underlying event records so investigators can identify periods of increased activity, locate higher-risk events, and drill into the events that occurred during the same period.

Read the Activity Timeline

Choose 24h, 7d, 30d, 90d, or Custom. Each bar represents event volume for a time slice, with the bar segmented by risk level. High and Critical events are also marked above the chart so significant activity remains visible even when the total event volume is low.


Indicator	Meaning
Red	Critical events
Orange	High-risk events
Yellow / Gold	Medium-risk events
Green	Low-risk events
Red or orange marker	An individual Critical or High-risk event

Up to 10 of the most recent High or Critical events in the selected range can appear as markers. Hover over a marker to view the event message, or select it to locate the corresponding event in the table.

Investigate a Specific Period

Click and drag across the chart to select a time window. The Event Logs table is filtered to that period, allowing an investigator to move directly from an activity spike or high-risk marker to the underlying event records. Clear the selected range to return to the full period.

Event Log Details


Field	Description
Timestamp	When the event occurred.
Resource	The resource associated with the event.
Event Type	The type of activity or change recorded.
Category	The event classification.
Action	The action associated with the event.
Outcome	The result of the action, such as Success.

Use Search, Columns, and Density to refine how the event records are displayed.

Usage

The Usage tab shows token consumption and cost for the selected agent. Use it to understand how the agent's AI usage changes over time and to review the individual consumption records behind those trends.

Token Usage

Token Usage shows token consumption over time. Select 7 days, 30 days, 3 months, or 6 months to change the period. The percentage indicator below the chart shows the change in token consumption for the displayed period.

Token Cost

Token Cost shows the cost associated with the agent's token consumption over time in USD. It uses the same time-range options, with a percentage indicator showing the change in cost for the displayed period.

Token Usage Logs

Token Usage Logs provide the underlying consumption records for the selected agent.


Field	Description
Timestamp	When the token usage was recorded.
Tokens	Number of tokens consumed for the recorded activity.
Cost (USD)	Cost associated with that token consumption.

Use Columns, Density, and pagination to adjust and review the records displayed in the table.

Investigation Workflow

The Managed Agent drill-down is designed to let an investigator move from a high-level risk signal to the underlying relationships and activity without leaving the agent context. A common investigation path is:

Start with Agent Risk to understand which risk area is contributing most to the agent's current score.
Use Agent Posture, Connections, Credentials, or Users to inspect the underlying finding or relationship.
Use Access Graph and Timeline to reconstruct how access relationships changed over time.
Use Event Logs to inspect the activity that occurred during the same period.
Use Usage when token consumption or cost is relevant to the investigation.