Skip to main content
Demo session – your progress won't be saved.Create Free Account
HAIEC
ConsoleD
Skip to monitoring content

Monitoring

Monitoring projection unavailable in the current evaluation.

This view projects recorded evidence and source health, not complete live execution coverage. A received telemetry signal is not an established action or effect. Refreshing the view does not guarantee a continuously connected collector. Missing data is not proof that no action or risk occurred.

Refresh requested: not since load

Open Reports

What is actually established

Passive telemetry
Projection unavailable

Source freshness could not be read.

Authorized runtime tests
Read unavailable

The runtime-test record could not be read — absence here is not proof no test ran.

Guardrail policy & evaluation
Projection unavailable

Configured policy and evaluated contradictions — configured is not enforced.

Native enforcement
Read unavailable

The enforcement ladder could not be read — treat as unknown, not absent.

Static Analysis
Not supplied
From code/config evidence.
Telemetry
Not supplied
Projection unavailable
Detection Signals
Not supplied
Agent & operational families

Monitoring projection is unavailable

No monitoring projection is available for this view in the current evaluation. This is unavailable data, not evidence that no activity or risk exists.

Review source onboardingLearn more

What HAIEC detects

Detection rules grouped by what they watch. A rule listed here is declared coverage – findings appear on the risks page only when a rule actually fires on evidence.

  • Container settings7 rules
    7 executable
    Show rules ▾
    • K8S-001A pod is running as the root user
    • K8S-002A container has a privileged security context
    • K8S-003A service account holds cluster-admin role
    • K8S-004No network policy covers a sensitive workload
    • K8S-005A secret is mounted without encryption
    • K8S-006Pod exec/attach came from an unexpected principal
    • K8S-007Pod uses host network, PID, or IPC access
  • Sign-in and tokens6 rules
    6 executable
    Show rules ▾
    • API-001Repeated 401/403 responses from the same principal
    • API-002Many different accounts tried from the same IP address
    • API-003An API key was used from an unusual location
    • API-004Rate limit exceeded repeatedly
    • API-005A deprecated authentication method is still in use
    • API-006The same token was used across tenant boundaries
  • Network name lookups5 rules
    5 executable
    Show rules ▾
    • DNS-001Subdomain queries carry unusually high entropy
    • DNS-002A CNAME points to an untrusted registrar
    • DNS-003A zone transfer was attempted
    • DNS-004A flood of NXDOMAIN responses from one source
    • DNS-005A stable name resolved with an unusually short TTL
  • Certificates5 rules
    5 declared only
    Show rules ▾
    • CERT-001An expired certificate is still active on an endpointdeclared only
    • CERT-002A certificate issuer changed without a recorded changedeclared only
    • CERT-003A public endpoint presents a self-signed certificatedeclared only
    • CERT-004A revoked certificate is still being presenteddeclared only
    • CERT-005A certificate uses a weak signature algorithmdeclared only
  • Clock drift5 rules
    5 declared only
    Show rules ▾
    • TIME-001The time source changed without a matching config updatedeclared only
    • TIME-002Clocks on different sources disagree beyond the thresholddeclared only
    • TIME-003An event carries a timestamp in the futuredeclared only
    • TIME-004Events arrived out of order by timestampdeclared only
    • TIME-005Multiple time sources disagreedeclared only
  • Message traffic6 rules
    6 executable
    Show rules ▾
    • MSG-001A producer published to a topic it never declared
    • MSG-002A consumer subscribed to an unexpected topic
    • MSG-003A message is far larger than the baseline pattern
    • MSG-004Message rate spiked above baseline
    • MSG-005A message does not match the declared schema
    • MSG-006The dead-letter queue is growing past the threshold
  • Exposed credentials5 rules
    5 executable
    Show rules ▾
    • SEC-001A secret value appears in source code
    • SEC-002An environment file was committed to the repo
    • SEC-003A secret-bearing environment variable appeared in logs
    • SEC-004A secret is older than the rotation policy allows
    • SEC-005A secret was read by a principal that never declared it
  • Config changes4 rules
    4 executable
    Show rules ▾
    • DRIFT-001A config file changed without a change request
    • DRIFT-002A declared value no longer matches the observed value
    • DRIFT-003A default value changed from the approved baseline
    • DRIFT-004A feature flag was toggled without an approval record
  • Data access5 rules
    5 executable
    Show rules ▾
    • DATA-001A large volume of sensitive records was read at once
    • DATA-002A query scanned a full table instead of using an index
    • DATA-003Data was read by a principal that never declared it
    • DATA-004Data belonging to another tenant was accessed
    • DATA-005An export moved an unusual volume of data
  • Agent actions10 rules
    6 executable4 declared only
    Show rules ▾
    • AI-001An agent invoked a model outside its declared setdeclared only
    • AI-002An agent used a tool it never declared
    • AI-003An agent wrote to memory outside its declared scope
    • AI-004An agent delegated to another agent with no recorded…
    • AI-005An agent handed work to an agent with no registered identity
    • AI-006A prompt template changed without a change recorddeclared only
    • AI-007An agent contacted a tool server not in the registry
    • AI-008Context was pulled from a knowledge source that was never…
    • AI-009An agent exceeded its declared step or action budgetdeclared only
    • AI-010An agent acted for a user with no matching session recorddeclared only
  • Supply chain8 rules
    8 executable
    Show rules ▾
    • SC-001A dependency version changed without a change record
    • SC-002A package in the bill of materials carries a known…
    • SC-003A dependency appeared that is not in the declared bill of…
    • SC-004A built artifact does not match the recorded bill of…
    • SC-005A dependency was pulled from an unapproved registry
    • SC-006An exploitability statement downgraded a vulnerability with…
    • SC-007A package publisher or maintainer changed
    • SC-008A transitive dependency gained new network permissions
  • Build pipeline5 rules
    5 declared only
    Show rules ▾
    • CICD-001A pipeline definition changed without a change requestdeclared only
    • CICD-002A pipeline ran from an unexpected trigger or branchdeclared only
    • CICD-003A pipeline accessed a secret it never declareddeclared only
    • CICD-004A pipeline deployed to an environment outside its declared…declared only
    • CICD-005A pipeline step ran with broader permissions than declareddeclared only
  • Prompt input5 rules
    5 executable
    Show rules ▾
    • PROMPT-001Prompt text asks the model to reveal its system instructions
    • PROMPT-002Prompt text matches a known jailbreak pattern
    • PROMPT-003A later conversation turn uses "established fact" phrasing…
    • PROMPT-004Prompt text tries to override prior instructions
    • PROMPT-005Input context exceeds the declared context limit
  • Retrieved content4 rules
    4 executable
    Show rules ▾
    • RAG-001A retrieved chunk came from a source outside the declared…
    • RAG-002A retrieved chunk contains instruction-like text
    • RAG-003Retrieved-set embedding signature differs from the declared…
    • RAG-004A chunk from one session surfaced in a different session
  • Agent memory2 rules
    2 executable
    Show rules ▾
    • MEM-001A memory write arrived through an undeclared channel
    • MEM-002A memory access touched a scope outside the declared scopes
  • Agent handoffs4 rules
    4 executable
    Show rules ▾
    • MULTI-001Two agents handed control back and forth in a loop
    • MULTI-002An agent handoff happened without a declared handoff
    • MULTI-003A handoff target has no registered agent identity
    • MULTI-004Different agents acted on the same target in one session
  • Tool calls4 rules
    4 executable
    Show rules ▾
    • MCP-001A tool was invoked that is not in the declared tool registry
    • MCP-002A call reached an MCP server outside the declared server…
    • MCP-003A tool presented a schema version different from its…
    • MCP-004A tool call came from an unregistered agent
  • Data leaving4 rules
    4 executable
    Show rules ▾
    • EXFIL-001Model output matched a sensitive-content pattern…
    • EXFIL-002Model output contained text matching the system-prompt…
    • EXFIL-003A tool-call payload matched a sensitive-content pattern
    • EXFIL-004A model-chain call reached a destination outside the egress…
  • Usage spikes4 rules
    4 executable
    Show rules ▾
    • COST-001Token usage spiked above its declared baseline
    • COST-002Retry volume crossed the retry-storm threshold
    • COST-003Token usage spiked inside a session containing an agent…
    • COST-004A model call originated from an undeclared surface
  • Agent authority3 rules
    3 executable
    Show rules ▾
    • AGENT-AUTH-001An observed actor is not in the declared delegation chain
    • AGENT-AUTH-002An observed scope exceeds the declared delegation scopes
    • AGENT-AUTH-003A tool-call actor appears in no declared delegation chain
  • Network policy5 rules
    5 executable
    Show rules ▾
    • RAPP-A1-001A policy diff exceeded the approved baseline threshold
    • RAPP-A1-002A policy came from an application that is not in the…
    • RAPP-A1-003Policy distribution divergence crossed the declared…
    • RAPP-A1-004A policy changed without a matching change request
    • RAPP-A1-005A policy targets a scope outside the issuing application…
  • Service calls8 rules
    8 executable
    Show rules ▾
    • SBI-001A consumer NF called a service outside its registered…
    • SBI-002A call flow deviated from the recorded baseline pattern
    • SBI-003A service-interface message failed schema validation
    • SBI-004A consumer function called without ever registering with…
    • SBI-005A call router sent traffic to a producer outside the…
    • SBI-006Service discovery request rate crossed the declared…
    • SBI-007A deregistered function was still active on the interface
    • SBI-008A service-interface call crossed slice boundaries
  • Network slices6 rules
    6 executable
    Show rules ▾
    • SLICE-001Traffic from one slice appeared on another slice
    • SLICE-002A UE attached to a cell outside the slice RAN subnet
    • SLICE-003Slice resource usage exceeded its allocated quota
    • SLICE-004A slice SLA metric breached its declared threshold
    • SLICE-005A data access crossed tenant boundaries inside a slice
    • SLICE-006A slice isolation policy was disabled or modified
  • Model behavior10 rules
    10 executable
    Show rules ▾
    • AML-001A served model version differs from the approved baseline
    • AML-002A served model hash differs from the approved hash
    • AML-003Input feature distribution drift crossed the declared…
    • AML-004Prediction variance exceeded baseline plus three standard…
    • AML-005Out-of-distribution score crossed the threshold
    • AML-006Model query rate crossed the declared threshold
    • AML-007The training data source changed without an approval record
    • AML-008Output distribution divergence crossed the declared…
    • AML-009The same input produced different outputs across repeated…
    • AML-010A model was accessed by a consumer outside the registered…
  • Delegated actions8 rules
    8 executable
    Show rules ▾
    • DEL-001A delegation chain expanded its observed scope
    • DEL-002A delegation chain head was not authenticated
    • DEL-003Delegation chain continuity was broken
    • DEL-004A sub-agent response carried a hidden command pattern
    • DEL-005A cross-agent privilege change was observed
    • DEL-006An RFC 8693 act-claim splice was detected in a chain
    • DEL-007An action was taken outside the declared delegation scope
    • DEL-008A delegation justification gap exceeded the declared…
  • Agent identity10 rules
    10 executable
    Show rules ▾
    • ID-001An agent identity is unknown to the registry
    • ID-002An OAuth client id is not mapped to a registered agent
    • ID-003A presented SPIFFE id differs from the expected identity
    • ID-004A delegation chain was not preserved across the hop
    • ID-005A scope reduction was not enforced down-chain
    • ID-006An agent attestation is missing or invalid
    • ID-007An agent profile does not match its execution surface
    • ID-008An agent trust profile is expired
    • ID-009An agent lineage chain is broken
    • ID-010A just-in-time grant was used as a standing privilege
  • Cell and tower access5 rules
    5 executable
    Show rules ▾
    • TOWER-001A handover moved a device to a cell outside the declared…
    • TOWER-002A device handover chain exceeded the declared baseline…
    • TOWER-003The same device appeared on multiple cells inside an…
    • TOWER-004An agent accessed a cell outside its declared scope
    • TOWER-005A device moved to a cell that is not in the declared…
  • App supply chain5 rules
    5 executable
    Show rules ▾
    • RAPP-SC-001An application artifact hash differs from the approved…
    • RAPP-SC-002An application artifact is missing a signature or the…
    • RAPP-SC-003Observed dependencies drifted from the approved set
    • RAPP-SC-004An application binary was modified after onboarding
    • RAPP-SC-005An unsigned application came from a third-party registry
  • App data leaving4 rules
    4 executable
    Show rules ▾
    • RAPP-EX-001Egress volume exceeded baseline plus the declared threshold
    • RAPP-EX-002An egress destination sits outside the approved allowlist
    • RAPP-EX-003A data selection was broader than the declared pattern
    • RAPP-EX-004Telemetry was read by an application that is not authorized…
  • App-to-app traffic4 rules
    4 executable
    Show rules ▾
    • RAPP-LM-001Traffic flowed between two applications never paired in the…
    • RAPP-LM-002The same credential was reused across application boundaries
    • RAPP-LM-003East-west traffic reached a peer outside the expected set
    • RAPP-LM-004A privilege escalation was observed inside the service mesh
  • Manufacturing operations10 rules
    10 executable
    Show rules ▾
    • MFG-001An operation was recorded as capable or executed with no…
    • MFG-002The observed effect landed on a different resource than the…
    • MFG-003An executed operation has no downstream readback or…
    • MFG-004A downstream readback names a different resource than the…
    • MFG-005A gate decision denied the operation but an execution…
    • MFG-AUTH-001A verified callable write path is reachable but excluded…
    • MFG-EFF-001A transaction-bound commit and independent qualified…
    • MFG-EFF-002A qualified dispatch has no consequence witness after…
    • MFG-QMS-001A committed release-class operation is excluded by the…
    • MFG-OBS-001A registered collector exceeded its qualified heartbeat…