Field Manual
Glossary
Use this glossary to keep incident notes, field reports, and documentation consistent.
Agentic event
A bounded sequence where an AI agent receives context, makes choices, uses tools or outputs instructions, and leaves evidence. Related: session, trace, provenance.
Agentic forensics
The practice of reconstructing activity from AI agents and agentic systems. Related: evidence preservation, telemetry, session store.
Agent memory
Persisted information used across agent runs. Related: session, continuation, context.
Agent trace
A sequence of observed activity across logs, telemetry, and tool records. Related: timestamp, correlation, normalized event.
Capability profile
A description of what tools or permissions an agent can use. Related: approval policy, sandbox, trust boundary.
Context window
The information available to a model at a point in time. Related: prompts, retrieved context, hidden instructions.
Conversation
Visible prompt and response turns. Related: hidden context, system instruction, tool side effect.
Detection class
A classification for the purpose of a detection rule. Values include security_detection, policy_violation, threat_hunting, compliance_observation, operational_health, and baseline_deviation. Related: signal type, analytic intent.
Detection event
A structured record produced when a rule matches agent activity. Contains rule IDs, risk score, categories, evidence, and response guidance. Related: rule category, risk score, triage.
Evidence hash
A cryptographic fingerprint of raw evidence used for correlation without exposing sensitive content. Related: redaction, provenance, evidence excerpt.
Evidence preservation
Collecting and protecting original records before analysis changes them. Related: redaction, chain of custody, source artifact.
Event sink
The delivery boundary for telemetry events. The default sink appends local JSONL; optional sinks wrap the same event payload for Splunk HEC or Elasticsearch. Related: telemetry, JSONL, SIEM.
MCP
Model Context Protocol, a standard for exposing tools and resources to AI clients. Related: MCP server, tool surface, permission boundary.
Normalization
Transforming varied source records into a common schema. Related: provenance, raw artifact, telemetry output.
Normalized record
A common record type produced by the normalization layer. Types include conversation.message, tool.call, tool.result, detection.event, and triage.event. Related: normalization, parser, schema.
Policy control
A YAML configuration that selects active rule categories and disables specific rules without editing rule files. Related: rule category, detection class.
Prompt injection
Input that attempts to alter instructions or behavior in an unintended way. Related: context window, tool-call review, triage.
Provenance
The origin and transformation history of evidence. Related: hash, chain of custody, normalization.
Redaction
Removing or masking sensitive content while retaining investigative value. Related: secret handling, evidence excerpt, privacy model.
Response contract
A deterministic object in detection events with recommended_action, response_playbook, investigation_summary, and escalation fields. Related: detection event, triage, SIEM.
Risk score
A numeric value (0+) derived from rule matches and context modifiers. Severity thresholds: 0-19 informational, 20-49 low, 50-69 medium, 70-89 high, 90+ critical. Related: detection event, severity, triage.
Rule category
A classification for detection rules mapping to common agent risk patterns. Categories include secret_access, credential_pattern, execution, download, install, exfiltration, persistence, approval_bypass, tool_injection, and mcp_prompt_injection. Related: detection event, risk score.
Session
The working context in which an agent acts. Related: session store, workspace, continuation.
Session risk summary
An optional per-session rollup event built from already-redacted activity and detection events. Provides one compact row per agent session for dashboards. Related: telemetry, event sink.
Session store
A local or remote persistence layer for session records. Related: agent memory, provenance, preservation.
Signal type
A classification for the nature of a detection signal. Values include atomic, chain, correlation, baseline_deviation, and llm_triage. Related: detection class, analytic intent.
Telemetry
Structured operational records produced by systems or tools. Related: JSONL, SIEM, normalized event.
Tool call
An agent-mediated request to read, write, run, query, browse, or invoke a capability. Related: MCP, trust boundary, capability profile.
Triage
An optional LLM-based review step that runs above configured risk thresholds. Produces a verdict (malicious, suspicious, benign, unknown) with confidence and reason. Related: risk score, detection event, response contract.
Trust boundary
A point where authority or capability changes. Related: MCP tool, shell command, API credential.