AI Activity Log Guide for Agent Risk Manager

The AI Activity Log is a record of the AI activity that Agent Risk Manager has received from your connected integrations. In this guide, you'll learn how to access the log, set a date range, review your AI activity coverage, review the events table, and export your data.

Access the AI Activity Log

Accessing your AI Activity Log varies slightly for customers using the classic KnowBe4 console and customers using the KnowBe4 Platform. See the subsections below for steps to log in.

Classic KnowBe4 Console

To access your AI Activity Log from the classic KnowBe4 console, follow these steps:

1. Log in to your classic KnowBe4 console.
2. In the top-left corner of the screen, select the grid icon. A dropdown menu will display.
3. In the dropdown menu, select Agent Risk Manager.
4. In the sidebar, select Discovery, then select AI Activity Log.

KnowBe4 Platform

To access your AI Activity Log from the KnowBe4 Platform, follow these steps:

1. Log in to your KnowBe4 Platform.
2. In the sidebar, select Agent Risk Manager.
3. Under Discovery, select AI Activity Log.

Set Your Date Range

The AI Activity Log shows events from the date range you select. To change your range, select the date range button and choose one of the following options:

• Past 7 Days
• Past 15 Days
• Past 1 Month
• Custom: This option opens a calendar so you can choose your own start and end dates.

Each preset includes the current day. The log opens to Past 15 Days by default.

Review AI Activity Coverage

The AI Activity Coverage bar shows how your organization's AI activity reached Agent Risk Manager and how much detail each source captures. The coverage bar shows all activity in your selected date range. Searching or filtering the events table doesn't change it.

Each segment of the bar shows the source the activity arrived through. One provider can have more than one source. The number inside a segment is that source's invocation count. To see a segment's name and count, hover over it.

The legend groups your sources into the following visibility tiers:

• Full visibility: Activity that Agent Risk Manager collects directly from the AI vendor's integration, so the full request and response are captured.
• Limited visibility: Activity captured by the KnowBe4 Browser Extension. The extension sees only what's in the browser tab, so these events carry less detail than activity collected directly from a vendor.

Review the Events Table

The Most recent logs table shows the newest individual events. You can sort the table by User, Event Type, and Date/Time. This table includes the following columns:

• Status: Shows the event's outcome as a badge:
  • Allowed: Nothing was detected.
  • Blocked: The request was stopped.
  • Canceled: The user stopped the response partway through. This status appears only for browser extension events.
  • Exception: Sensitive data was found, but every data type involved is an approved exception for that provider.
  • Flagged: A detection was triggered on the event.
  • Logged: The event was recorded for the audit trail, with no detection outcome.
• User: Shows the user associated with the event. Long values are shortened. To see the full value, hover over it.
• Provider: Shows the provider behind the activity. Browser extension events don't show a provider, because only the site's address is recorded. These events show a dash icon and appear under No provider in the filter.
• AI Surface: Shows the AI product or interface where the activity happened. For browser extension events, this column shows the site or tool where the activity was seen. Long values are shortened. To see the full value, hover over it.

• Coverage: Shows whether Agent Risk Manager recognizes the tool behind the event. A check icon means Recognised and a triangle icon means Unknown AI. Events that don't name a tool show a dash icon and appear under No tool in the Coverage filter. To see what an icon means, hover over it.

  Note: Recognisedmeans the tool is in your inventory. It doesn't mean a policy was applied to the event.
• Event Type: Shows the event's type. To see the specific event behind the type, hover over it.
• Source: Shows the direction of the activity in the conversation. If the direction can't be determined, a dash icon displays. If the direction can be determined, it shows as a badge:
  • Agent Thinking
  • Agent → Agent
  • Agent → User
  • User → Agent
• Date/Time: Shows when Agent Risk Manager recorded the event.

Search and Filter Events

To narrow your table data, use the Search and Filter options at the top of the table.

The following filter options are available:

• User: Shows only events from the users you select, listed by email address.
• Status: Shows only events with the statuses you select. You can choose Blocked, Flagged, Exception, Allowed, or Logged, and you can select more than one. For more information on each status, see the Review the Events Table section.
• Event Type: Shows only events of the types you select. You can choose Excessive Agency, Prompt Injection, Sensitive Information, or Unbounded Consumption, and you can select more than one. For more information, see our events and categories guide.
• Provider: Shows only events from the providers you select. Events without a provider are listed as No provider.
• AI Surface: Shows only events from the AI products or interfaces you select.
• Coverage: Shows only events with the coverage you select. You can choose Recognised, Unknown AI, or No tool.
• Source: Shows only events from the conversation directions you select. You can choose User → Agent, Agent → Agent, or Agent Thinking.

View Event Details

To see everything Agent Risk Manager recorded about a single event, select its row in the events table to open the Event Details panel. To close the panel, select the X icon in the top-right corner.

The top of the panel shows badges for the event's class, status, and source, followed by the event's title, timestamp, and user. If another source added details to the event, an Enriched by Integration badge also appears.

The Event Details panel is organized into the following tabs:

• Overview: A summary of the event in the following order:
  • Unknown AI tool: A warning that appears only for AI tools Agent Risk Manager doesn't recognize. If the browser extension is enabled for your account, this warning includes an Add a policy rule option.
  • What happened: A sentence that describes what Agent Risk Manager detected, which user started the activity, and which agent was involved.
  • Details / Metadata: The event's raw metadata text.
  • Severity: The event's severity level, which includes Critical, Warning, Info, Low, or Unknown.
  • Policy: The policy applied to the event.
  • Event ID: The event's unique identifier.
  • Agent ID: The identifier of the agent involved in the event.
• Activity: The status of the event's prompt and response, followed by a timeline of how Agent Risk Manager processed the event. Prompt received and Logged always appear. Received from source and Processed by detection engines appear only for events that recorded those stages.

• Metadata: A record of the following metadata fields:

  • Event ID: The event's unique identifier.
  • Agent ID: The identifier of the agent involved in the event.
  • Timestamp: When the event was recorded.
  • User: The user's name with their email address beneath it. If no name was recorded, only the email address appears.
  • Agent: The agent involved in the event.
  • Tool: The tool involved in the event.
  • AI Site Login: The email address the user logged in to the AI site with. This information appears only for browser extension events.
  • Login Type: The type of login used for the event, which includes Corporate, Personal, Not detected, or Unavailable. This information appears only for browser extension events.
  • Captured In: The website address where the browser extension saw the activity. This information appears only for browser extension events.
  • Provider: The provider behind the activity.
  • AI Surface: The AI product or interface where the activity happened.
  • Category: The event's category, which includes Detection, Block, Exception, Benign, or Agent Schema Discovery.
  • Severity: The event's severity level, which includes Critical, Warning, Info, Low, or Unknown.
  • Status: The event's status.
  • Session ID: The identifier of the conversation the event came from.
  • Plan ID: The identifier of the plan the agent followed for the request.
  • Tenant ID: Your organization's tenant identifier.
  Note:Any field without a value shows Not Captured, except Severity, which shows Unknown.

• User Activity: The user's events from the 24 hours before the event you opened, newest first. Each row shows the event type, the agent or AI surface, the tool, a status badge, and the time. The event you opened is included and marked This event.

  Note:Some events can't be matched to a specific user, such as events from public or unauthenticated sessions.

Export Your Data

You can export AI Activity Log events as a CSV file. To export your data, follow these steps:

1. In the top-right corner of the page, select Export. This action will open the Export Audit Log window.

2. Select a Date Range.

   Note:Only dates within the last 6 months are available for export.
3. All Sources are included by default. You can also narrow the sources by selecting them from the Source drop-down menu.
4. Select Request export.

After you request an export, it will appear in the Recent Exports section of the Export Audit Log window, below the Source field. When its status is Ready, select Download to save your CSV file. Your 20 most recent exports stay available to download again.