# Behavioural analytics for your Avispa agents.

URL: https://avispa.ai/orbitsoc/agent-monitoring/

Avispa OrbitSOC: Agent Monitoring

OrbitSOC learns how each Avispa agent works, flags anomalous behaviour and pauses an agent when your rules say so.

Agent monitoring

- **1** · Teams
- **5** · Agents
- **1,169** · Events, 24 h
- **291** · Tool calls, 24 h
- **17** · Denied connections
- **10** · Guardrail blocks
- **2** · Detections, 24 h
- **1** · Paused for review

Avispa’s audit sources, metadata only

- Activity
- Security events
- Egress traffic
- Egress denials
- File audit
- Guardrail decisions

## Everything it does.

For every Avispa agent: what it catches, what it learns, and what you can see and keep.

- 01 · Detections · Rules built for agents, every minute.
  - A tool outside its grant
  - Permission changes and new agents
  - Prompt injection and guardrail outages
  - Never-seen and risky destinations
  - Data sent far above its usual
  - ATT&CK, ATLAS and OWASP Agentic
  - “Is this normal?” on each one
- 02 · Behaviour anomalies · Behavioural analytics flag what’s unusual.
  - Six measures against the 7 days before
  - An hourly radar on four measures
  - Weekly rhythm, 28 days
  - New destinations marked
  - A fingerprint of how it usually runs
  - Someone else driving the agent
- 03 · Canary tokens · Decoys no task should touch.
  - “Admin vault” decoy tools
  - A decoy host, two files and a token
  - A critical detection on any touch
  - Automatic pause on a touch, if you choose
  - Touches, last 30 days
- 04 · Custom detections · Your own rules, from a search.
  - Every time, many times or the first time
  - Followed by, or not followed by
  - Start from a search, events or a preset
  - “Describe what to catch”, drafted by your AI
  - Tested against the last 7 days
  - Exceptions with an owner and an expiry
- 05 · Security posture · How each agent is set up, scored out of 100.
  - Built-in posture checks
  - Your own posture checks
  - Unknown, never assumed passing
  - Risk from five parts
  - Least privilege from what it used
  - Models, MCP servers and tools in one inventory
  - Unapproved AI flagged
- 06 · Search · Every event, one query away.
  - Search in SPL, shown as KQL, Lucene, ES|QL or LogScale
  - “Describe what you want to find”
  - Patterns, fields and a summary
  - Saved and scheduled searches
  - Bucket search back 2 years
- 07 · Visualize · The fleet at a glance.
  - Activity by agent and hour
  - Change from usual, per agent
  - Access and reach graph
  - Risk by agent
  - Dashboards you build
  - PDF reports
- 08 · Observe · Every run and every record, kept.
  - Run replay, step by step
  - How a run differs, and a map across agents
  - Feed health and audit integrity
  - Instance setting changes
  - OCSF to Splunk, Sentinel, Google SecOps, Cribl or HTTPS
  - Retention you set; no prompts or responses stored

## Auto pause, for human review.

Choose what pauses an agent. When one fires, OrbitSOC pauses it at once, keeps its work and hands it to a person.

Containment

Off · On command · Automatic

Pause an agent automatically when

- Its risk score reaches · 75 or more
- It touches a canary or decoy · Decoy tool called · Decoy touched
- A detection you chose fires · AVS-032 Agent sent far more than it received
- Any detection at or above a severity · High

Breaker: 10 automatic pauses in an hour stop it until an admin turns it back on.

Network Engineer paused automatically

AVS-032 · High · 15:11 UTC

Waiting for review. Its work is kept.

OrbitSOC or an Avispa instance admin resumes it: one agent at a time, with a reason.

On command, one click

- Pause or resume an agent
- Pause a team
- Stop or resume every agent on an instance
- Plant or remove decoy tools
- Narrow an agent’s allowlist

## Anomalous behaviour, spotted.

One agent breaks from its usual, and a SOC lead pauses it in one click.

**OrbitSOC** · Agent monitoringAgent behaviour

Connected · Avispa Enterprise · Last events 1 min ago

1. Network Engineer · Paused since 15:12 · ×15.2 · Within usual · Above usual · Paused
2. RBAC Engineer · ×0.9 · Within usual
3. Diagnostics Engineer · ×1.1 · Within usual
4. Provisioning Engineer · ×1.0 · Within usual
5. Cost Engineer · ×0.8 · Within usual

Detections

No new detections

- Agent sent far more than it received · High · 15:00
- Never-seen destination · Medium · 14:00

files.example.net · New · 176 MB · Network Engineer sent 182 MB; usual 9 to 16 MB a day

Actions awaiting decision

Nothing awaiting decision

**Pause Network Engineer** · Proposed by a detection

SOC lead · On call

Approved by the SOC lead at 15:12 · Carried out through Avispa’s API, and audited

**More: every detection, one agent, its scope, radar and posture**

## Detections built for Avispa agents.

Each lands in Agent monitoring’s own queue for your team to triage.

Detections for Avispa agents

| Agent tried a tool it was not given | High |
| --- | --- |
| Agent changes its own permissions | Medium to high |
| Agent created another agent | Medium to high |
| Decoy tool called | Critical |
| Decoy touched | Critical |
| MCP server changed after it was first seen | Medium |
| Secret file read | High to critical |

| Never-seen destination | Low to medium |
| --- | --- |
| Risky destination | Medium to high |
| Agent sent far more than it received | High |
| Agent tried many refused or private hosts | High |
| Cloud metadata access | High to critical |
| Team’s outbound network limits weakened | High |
| Agents allowed to reach more hosts | High |

| Guardrail flagged text trying to steer an agent | Medium to high |
| --- | --- |
| Guardrail down, requests going through unchecked | Medium |

| Activity feed went quiet or forwarding changed | Up to critical |
| --- | --- |

| Agent created or changed a routine | High to critical |
| --- | --- |
| Agent acted after recalling untrusted memory | High |

| Someone else may be driving this agent | Medium |
| --- | --- |
| Unapproved AI used | Medium |

Marked: the Network Engineer’s two. Each names its OWASP Agentic risk, and most a MITRE ATT&CK or ATLAS technique.

## One agent, in OrbitSOC’s views.

Its team, its usual, where it sent data and its guardrails.

Agent monitoring

Overview · Agent behaviour · Network · AI safety · Exposure · Detections · Actions · Team: Azure Platform Engineering

Agents, by what needs attention

| Agent | Events | Tool calls | Denied | Hosts | Sent | Detections |
| --- | --- | --- | --- | --- | --- | --- |
| Network Engineer | 412 | 96 | 14 | 9 | 182 MB | 2 |
| RBAC Engineer | 140 | 38 | 2 | 3 | 0.4 MB | 0 |
| Diagnostics Engineer | 233 | 64 | 1 | 5 | 1.2 MB | 0 |
| Provisioning Engineer | 288 | 71 | 0 | 4 | 3.1 MB | 0 |
| Cost Engineer | 96 | 22 | 0 | 2 | 0.2 MB | 0 |

Detections first, then denials, then activity.

Network Engineer, against its usual

- **Events**: *Within*

- **Tool calls**: *Within*

- **Active hours**: *Within*

- **Denials**: *Within*

- **Hosts**: *Within*

- **Data sent**: *Above*

Above usual: higher than any of the 7 days before. Under 3 days of history, it shows Learning.

Destinations, last 24 hours

- management.azure.example · 1,180 req · 1.4 MB
- graph.identity.example · 214 req · 0.3 MB
- files.example.net · New · 37 req · 176 MB

New: first contacted in the last 24 hours, and not in the 30 days before.

Guardrail verdicts, last 24 hours

| Category | Blocked | Warned | Allowed |
| --- | --- | --- | --- |
| Harmful content | 0 | 2 | 214 |
| Sensitive data | 1 | 3 | 18 |
| Destinations | 9 | 0 | 61 |

Categories as Avispa sends them.

Weekly rhythm, last 28 days

**Mon** · **Tue** · **Wed** · **Thu** · **Fri** · **Sat** · **Sun**

00 · 06 · 12 · 18 · 23

Events by weekday and hour, UTC.

OrbitSOC’s own views of an Avispa Enterprise instance.

## Declared against observed.

Avispa reports each agent’s declared scope every 5 minutes, and every tool call is checked against it.

Tool calls, last 24 hours

- **Declared scope, read from Avispa every 5 minutes**

- **Tool servers**: network, dns, storage, search

- **Allowed tools**: 5 listed; search allows every tool

- **Permission grants**: Network Contributor on rg-network

- **Can create agents**: No

| Tool | Calls | In declared scope |
| --- | --- | --- |
| network.list\_vnets | 41 | Yes |
| network.update\_nsg | 12 | Yes |
| search.query | 6 | Cannot tell |
| storage.upload\_blob | 3 | No |

Cannot tell: the server allows every tool, so there is no list to check.

Allowed but never used in 30 days

- network.delete\_vnet
- dns.update\_zone

## Every hour, and how they’re set up.

Hourly, the radar scores each agent against its last 30 hours. Posture shows how agents are set up.

Radar, this hour

| Agent | Tool calls | Denials | Hosts | Data sent |
| --- | --- | --- | --- | --- |
| Network Engineer |  |  |  |  |
| RBAC Engineer |  |  |  |  |
| Diagnostics Engineer |  |  |  |  |
| Provisioning Engineer |  |  |  |  |
| Cost Engineer |  |  |  |  |

Each bar: how far this hour is from the agent’s last 30 hours. An outlier raises a detection.

Agent posture

| Finding | Found |
| --- | --- |
| Agents with every tool of a server | 2 |
| Agents that can create agents | 1 |
| Unsigned webhooks | 3 |
| Agents holding a permission with no scope | 0 |

Each finding names the agents or webhooks behind it.

## Watch your own agents.

[Book a demo](https://avispa.ai/book-a-demo/)