Logs & Findings

On the Findings page, you can view detailed event logs of AI usage and detections in your enterprise. You can filter the data by time range, attributes, and detection categories to focus on specific activity.

Filters based on supported attributes also apply to the Visibility page. You can correlate specific events and detections with visualized data flows.

Time-series chart

At the top of the page, after the filters, a time-series chart visualizes activity over time. Hover over any data point to view counts for the selected time interval. The chart groups data by the attributes you select on the Visibility page.

Logs table

The logs table lists events with columns for event attributes.

• At the top of the table, select how many rows to show per page.
• Click the gear icon in the top-right corner to add or remove columns.
• Click a column header to sort by that attribute. An arrow icon shows the sort order, ascending or descending.
• Drag the right edge of a column header to resize columns.
• Use the pagination controls to navigate between pages.
• Hover over table cells to view additional details, such as a status summary or a breakdown by detection type. Click the plus icon next to the value to add it as a filter.

Log details

Click a row in the logs table to view full details for that event. The row expands to show all event attributes, including those not visible in the table.

If a field, such as Guard Input or Findings, contains JSON data, you can explore it as an interactive JSON tree.

Filter event content

In the Guard Input field, click the link icon to open the actions menu. From this menu, you can expand specific parts of the content that AIDR analyzed or detected:

• Expand processed data - Expands the JSON paths that AIDR analyzed during inspection. These paths correspond to the analyzed_paths values in each detector's findings.
• Expand detected data - Expands only the JSON paths where a detector reported a positive detection, indicated by "detected": true.
• Expand all data - Expands every entry under Guard Input.

With these options, you can identify which parts of the conversation AIDR inspected and where detections occurred.

Mark as benign

When you expand an event log that contains a malicious prompt detection, you can mark the detected prompt as benign. This adds the prompt to your CID-wide Benign Prompts list. After you add a prompt, AIDR does not flag semantically similar prompts as malicious.

The Mark prompt as benign action is available when:

• The Malicious Prompt detector reports a detection in a message path.

  Example analyzed paths in Findings

  {
    "malicious_prompt": {
      "detected": true,
      "analyzed_paths": [
        "context.tools",
        "messages[0]"
      ],
      ...
    },
    ...
  }

• The prompt content is 80 characters or more.

• The prompt is not on the Benign Prompts list.

Mark prompt as benign

1. Expand an event log that contains a malicious prompt detection.

2. Click the Mark prompt as benign guard icon.

   Depending on the policy configuration, AIDR might ask you to enable required settings before proceeding:

   • If the Malicious Prompt detector is disabled for the policy, AIDR asks you to enable it.

     Click Enable to enable the detector and its Custom Benign Prompt Detection setting.

   • If the Malicious Prompt detector is already enabled but Custom Benign Prompt Detection is not, AIDR asks you to enable that setting.

     Click Enable to proceed.

   note:

   You can also enable the Malicious Prompt detector and Custom Benign Prompt Detection on the collector's policy page, under Inspection Rules.

   AIDR adds the prompt to the Mark as benign queue. The guard icon turns orange and its tooltip indicates the prompt is queued.

3. Add up to five distinct prompts to the queue.

   AIDR deduplicates identical prompts automatically. If the same prompt appears in multiple event logs, all occurrences share a single queue entry and highlight together as queued.

   To remove a prompt from the queue, click its orange guard icon.

4. Click Review to open Review benign prompts to add.

   • Click Edit to adjust the prompt content before submitting.
   • Click Cancel to close without saving and continue adding prompts to the queue.
   • Click Confirm & Add to add all queued prompts to your CID-wide Benign Prompts list.

   You can add up to 100 benign prompt examples to the list.

   Events with prompts already on the list display a green Marked as benign icon.

Benign Prompts list

To view, edit, add, or delete benign prompt examples, go to AI detection and response > Settings > Model Settings > Benign Prompts. On the Benign Prompts page, you can also adjust Similarity Threshold for benign prompt examples.

AIDR does not flag prompts as malicious when they are semantically similar to entries on the list and within the similarity threshold.

Filters

You can limit the data on the Findings page with filters.

You can filter by these dimensions:

• Detections - Show only events that triggered detections defined in collector policies.
• Time range - Show events within a specific time window.
• Attribute values - Show events matching specific attributes, such as a particular user, application, or other entity. Available attributes include top-level event fields and individual subfields from composite objects, such as extra_info.user_name or authn_info.identity_name.

You can combine multiple dimensions in a single filter. For example, to find all events from the last 7 days that triggered a detection and involved a specific user:

1. Select Last 7 Days in the date range dropdown.

2. Click DETECTIONS.

3. Click + Add Filter, then:

   1. Select User ID from the list of attributes.

   2. Select the contains operator.

   3. Enter jeffrey to search for a user with this value in their ID.

      When you place the cursor in the field, the console suggests the most common values from the last month of data. The console sorts values by frequency. Each suggestion displays how often the value appeared, such as Seen in 1.2K events.

4. Click Update Filter.

Active filters appear as labels below the search bar. Click a condition to edit the filter.

To save your filters for reuse, click the save icon.

Quick filters

You can apply filters by clicking the following elements on the Findings page:

• DETECTIONS button - Limit the data to events that triggered a detection defined in your policies. Click ACTIVITY to remove this filter and return to the full event view.
• Date range dropdown - Select a predefined time range from the dropdown next to the search bar. You can also define a custom range and apply your own interval.

Search bar

In the search bar at the top of the page, create filters with specific attributes and operators. When you place your cursor in the field, a dropdown displays the available options. Select an attribute and operator, enter a value to match, and press Enter to apply the condition.

Filtered views

Click + Add Filter to create filters. Within a filter, you can combine conditions using AND or OR logic. Multiple filters combine with AND logic.

Each filter is cumulative and helps you narrow results to specific subsets of your data.

Applied conditions appear as pills at the top of the page, below the search bar. Click a condition to reveal the edit link, then click the link to modify the condition.

To save the current filter set, click the save icon next to the filter dropdown in the top right of the page. When unsaved changes exist, the icon appears yellow. After you save, it turns white.

Apply a saved filter set by selecting it from the filter dropdown.

To refresh the displayed data, click the refresh icon next to the filter dropdown.

Table filters

You can filter data in the logs table:

• Search and filter by attribute values.
• Apply a time range filter from an event timestamp.

Filter by attributes

To open the attribute filter, click the funnel icon in a column header. You might need to drag the column's right edge to reveal it.

You can build conditions with available attributes and combine them with AND or OR logic.

Apply time range

You can apply a time range filter directly from the logs table. Add a time field to the table columns, then hover over its value in a row. Click the plus icon next to it to filter by that exact date or set it as a range boundary.