Avispa OrbitSOC: Agent Monitoring
Behavioural analytics for your Avispa agents.
OrbitSOC learns how each Avispa agent works, flags anomalous behaviour and pauses an agent when your rules say so.
- 1Teams
- 5Agents
- 1,169Events, 24 h
- 291Tool calls, 24 h
- 17Denied connections
- 10Guardrail blocks
- 2Detections, 24 h
- 1Paused for review
Avispa’s audit sources, metadata only
- Activity
- Security events
- Egress traffic
- Egress denials
- File audit
- Guardrail decisions
Everything it does.
For every Avispa agent: what it catches, what it learns, and what you can see and keep.
01
Detections
Rules built for agents, every minute.
- A tool outside its grant
- Permission changes and new agents
- Prompt injection and guardrail outages
- Never-seen and risky destinations
- Data sent far above its usual
- ATT&CK, ATLAS and OWASP Agentic
- “Is this normal?” on each one
02
Behaviour anomalies
Behavioural analytics flag what’s unusual.
- Six measures against the 7 days before
- An hourly radar on four measures
- Weekly rhythm, 28 days
- New destinations marked
- A fingerprint of how it usually runs
- Someone else driving the agent
03
Canary tokens
Decoys no task should touch.
- “Admin vault” decoy tools
- A decoy host, two files and a token
- A critical detection on any touch
- Automatic pause on a touch, if you choose
- Touches, last 30 days
04
Custom detections
Your own rules, from a search.
- Every time, many times or the first time
- Followed by, or not followed by
- Start from a search, events or a preset
- “Describe what to catch”, drafted by your AI
- Tested against the last 7 days
- Exceptions with an owner and an expiry
05
Security posture
How each agent is set up, scored out of 100.
- Built-in posture checks
- Your own posture checks
- Unknown, never assumed passing
- Risk from five parts
- Least privilege from what it used
- Models, MCP servers and tools in one inventory
- Unapproved AI flagged
06
Search
Every event, one query away.
- Search in SPL, shown as KQL, Lucene, ES|QL or LogScale
- “Describe what you want to find”
- Patterns, fields and a summary
- Saved and scheduled searches
- Bucket search back 2 years
07
Visualize
The fleet at a glance.
- Activity by agent and hour
- Change from usual, per agent
- Access and reach graph
- Risk by agent
- Dashboards you build
- PDF reports
08
Observe
Every run and every record, kept.
- Run replay, step by step
- How a run differs, and a map across agents
- Feed health and audit integrity
- Instance setting changes
- OCSF to Splunk, Sentinel, Google SecOps, Cribl or HTTPS
- Retention you set; no prompts or responses stored
Auto pause, for human review.
Choose what pauses an agent. When one fires, OrbitSOC pauses it at once, keeps its work and hands it to a person.
OffOn commandAutomatic
Pause an agent automatically when
- Its risk score reaches75 or more
- It touches a canary or decoyDecoy tool called · Decoy touched
- A detection you chose firesAVS-032 Agent sent far more than it received
- Any detection at or above a severityHigh
Breaker: 10 automatic pauses in an hour stop it until an admin turns it back on.
Network Engineer paused automatically
AVS-032 · High · 15:11 UTC
Waiting for review. Its work is kept.
OrbitSOC or an Avispa instance admin resumes it: one agent at a time, with a reason.
On command, one click
- Pause or resume an agent
- Pause a team
- Stop or resume every agent on an instance
- Plant or remove decoy tools
- Narrow an agent’s allowlist
Anomalous behaviour, spotted.
One agent breaks from its usual, and a SOC lead pauses it in one click.
ConnectedAvispa EnterpriseLast events 1 min ago
- Network Engineer Paused since 15:12 ×1.0×15.2 Within usualAbove usualPaused
- RBAC Engineer ×0.9 Within usual
- Diagnostics Engineer ×1.1 Within usual
- Provisioning Engineer ×1.0 Within usual
- Cost Engineer ×0.8 Within usual
Detections
No new detections
- Agent sent far more than it receivedHigh15:00
- Never-seen destinationMedium14:00
files.example.netNew176 MBNetwork Engineer sent 182 MB; usual 9 to 16 MB a day
Actions awaiting decision
Nothing awaiting decision
Pause Network EngineerProposed by a detection
Approved by the SOC lead at 15:12Carried out through Avispa’s API, and audited
More: every detection, one agent, its scope, radar and posture
Detections built for Avispa agents.
Each lands in Agent monitoring’s own queue for your team to triage.
| Agent tried a tool it was not given | High |
|---|---|
| Agent changes its own permissions | Medium to high |
| Agent created another agent | Medium to high |
| Decoy tool called | Critical |
| Decoy touched | Critical |
| MCP server changed after it was first seen | Medium |
| Secret file read | High to critical |
| Never-seen destination | Low to medium |
|---|---|
| Risky destination | Medium to high |
| Agent sent far more than it received | High |
| Agent tried many refused or private hosts | High |
| Cloud metadata access | High to critical |
| Team’s outbound network limits weakened | High |
| Agents allowed to reach more hosts | High |
| Guardrail flagged text trying to steer an agent | Medium to high |
|---|---|
| Guardrail down, requests going through unchecked | Medium |
| Activity feed went quiet or forwarding changed | Up to critical |
|---|
| Agent created or changed a routine | High to critical |
|---|---|
| Agent acted after recalling untrusted memory | High |
| Someone else may be driving this agent | Medium |
|---|---|
| Unapproved AI used | Medium |
Marked: the Network Engineer’s two. Each names its OWASP Agentic risk, and most a MITRE ATT&CK or ATLAS technique.
One agent, in OrbitSOC’s views.
Its team, its usual, where it sent data and its guardrails.
OverviewAgent behaviourNetworkAI safetyExposureDetectionsActionsTeam: Azure Platform Engineering
Agents, by what needs attention
| Agent | Events | Tool calls | Denied | Hosts | Sent | Detections |
|---|---|---|---|---|---|---|
| Network Engineer | 412 | 96 | 14 | 9 | 182 MB | 2 |
| RBAC Engineer | 140 | 38 | 2 | 3 | 0.4 MB | 0 |
| Diagnostics Engineer | 233 | 64 | 1 | 5 | 1.2 MB | 0 |
| Provisioning Engineer | 288 | 71 | 0 | 4 | 3.1 MB | 0 |
| Cost Engineer | 96 | 22 | 0 | 2 | 0.2 MB | 0 |
Detections first, then denials, then activity.
Network Engineer, against its usual
- Events
- Within
- Tool calls
- Within
- Active hours
- Within
- Denials
- Within
- Hosts
- Within
- Data sent
- Above
Above usual: higher than any of the 7 days before. Under 3 days of history, it shows Learning.
Destinations, last 24 hours
- management.azure.example1,180 req1.4 MB
- graph.identity.example214 req0.3 MB
- files.example.netNew37 req176 MB
New: first contacted in the last 24 hours, and not in the 30 days before.
Guardrail verdicts, last 24 hours
| Category | Blocked | Warned | Allowed |
|---|---|---|---|
| Harmful content | 0 | 2 | 214 |
| Sensitive data | 1 | 3 | 18 |
| Destinations | 9 | 0 | 61 |
Categories as Avispa sends them.
Weekly rhythm, last 28 days
0006121823
Events by weekday and hour, UTC.
Declared against observed.
Avispa reports each agent’s declared scope every 5 minutes, and every tool call is checked against it.
- Declared scope, read from Avispa every 5 minutes
- Tool servers
- network, dns, storage, search
- Allowed tools
- 5 listed; search allows every tool
- Permission grants
- Network Contributor on rg-network
- Can create agents
- No
| Tool | Calls | In declared scope |
|---|---|---|
| network.list_vnets | 41 | Yes |
| network.update_nsg | 12 | Yes |
| search.query | 6 | Cannot tell |
| storage.upload_blob | 3 | No |
Cannot tell: the server allows every tool, so there is no list to check.
Allowed but never used in 30 days
- network.delete_vnet
- dns.update_zone
Every hour, and how they’re set up.
Hourly, the radar scores each agent against its last 30 hours. Posture shows how agents are set up.
| Agent | Tool calls | Denials | Hosts | Data sent |
|---|---|---|---|---|
| Network Engineer | ||||
| RBAC Engineer | ||||
| Diagnostics Engineer | ||||
| Provisioning Engineer | ||||
| Cost Engineer |
Each bar: how far this hour is from the agent’s last 30 hours. An outlier raises a detection.
| Finding | Found |
|---|---|
| Agents with every tool of a server | 2 |
| Agents that can create agents | 1 |
| Unsigned webhooks | 3 |
| Agents holding a permission with no scope | 0 |
Each finding names the agents or webhooks behind it.