--- title: Agent Events description: >- Search and analyze the runtime activity that the Datadog Agent sends to Datadog as Agent events. breadcrumbs: >- Docs > Datadog Security > Workload Protection > Investigate and Triage > Agent Events --- > For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt). # Agent Events The Datadog Agent evaluates system activity on the Agent host. When activity matches an Agent rule expression, the Agent generates an event and passes it to the Datadog backend. With the [Agent Events Explorer](https://app.datadoghq.com/security/agent-events), you can investigate Agent events separately from signals. Review what happened, where it occurred, and which Agent rule matched using the event side panel. You can also explore the investigation graph, event tree, and raw JSON payload, and view triage and response instructions for the matching rule. ## Investigate Agent events{% #investigate-agent-events %} To investigate an Agent event: 1. Go to the [Agent Events Explorer](https://app.datadoghq.com/security/agent-events). Agent events are queried and displayed using the standard explorer controls in the Datadog [Events Explorer](https://docs.datadoghq.com/events/explorer.md). 1. Select an Agent event. The side panel opens with tabs that help you investigate the event. ### Overview{% #overview %} The Overview tab summarizes the event and is often the best place to start your investigation. {% image source="https://docs.dd-static.net/images/security/workload_protection/investigate_and_triage/agent_events/agent_event_overview.bee712ef152a713efdc8559181d02026.png?auto=format&fit=max&w=850 1x, https://docs.dd-static.net/images/security/workload_protection/investigate_and_triage/agent_events/agent_event_overview.bee712ef152a713efdc8559181d02026.png?auto=format&fit=max&w=850&dpr=2 2x" alt="Agent event side panel Overview tab showing What, Where, Agent rule, and Investigation graph sections" /%} The Overview tab includes the following sections: - What: A human-readable description of the detected activity. For example, *A user executed the clang command on host i-0d85f97942d947ca9*. - Where: The infrastructure context where the event occurred, including cloud provider, account, region, host, Kubernetes cluster, namespace, pod, container, and image. - Agent rule: The Agent rule that matched the event, including the rule name, event name, deployment policies, policy version, and rule expression. - Investigation graph: A preview of the investigation graph at the bottom of the Overview tab. - Event Tree: The execution lineage, affected infrastructure, and process, file, network, or kernel activity associated with the event. #### Investigation graph{% #investigation-graph %} The Investigation graph is an interactive visualization that maps the infrastructure and processes involved in the event. It provides a compact overview of the attack chain by highlighting the most relevant entities and processes. {% image source="https://docs.dd-static.net/images/security/workload_protection/investigate_and_triage/agent_events/agent_event_investigation_graph.ad5f58b9c777f6962aab5f25ecdc4e84.png?auto=format&fit=max&w=850 1x, https://docs.dd-static.net/images/security/workload_protection/investigate_and_triage/agent_events/agent_event_investigation_graph.ad5f58b9c777f6962aab5f25ecdc4e84.png?auto=format&fit=max&w=850&dpr=2 2x" alt="Investigation graph showing host, Kubernetes pod, container, image, and main process execution path" /%} The graph traces the event from the host through the surrounding infrastructure—such as the Kubernetes pod, replica set, container, and container image—and into the process execution path. Main processes involved in the event are displayed individually, while less relevant processes are aggregated into grouped nodes (for example, **+7 processes**) to keep the view focused on the suspicious activity. Use the investigation graph to understand how the detected activity fits into the broader runtime context without reviewing every process on the host. #### Event tree{% #event-tree %} The Event Tree traces execution from the system init process through intermediate processes to the matching process, file, network, or kernel activity. Use it to reconstruct the execution path that led to the event and identify the affected infrastructure. {% image source="https://docs.dd-static.net/images/security/workload_protection/investigate_and_triage/agent_events/agent_event_tree.6afbd96deb295f48562f6d018a260bd6.png?auto=format&fit=max&w=850 1x, https://docs.dd-static.net/images/security/workload_protection/investigate_and_triage/agent_events/agent_event_tree.6afbd96deb295f48562f6d018a260bd6.png?auto=format&fit=max&w=850&dpr=2 2x" alt="Event tree showing the affected host, pod, container, process lineage, and file activity for an Agent event" /%} Each process entry displays: - Path: The executable path and command-line arguments. - PID: The process ID. - User: The user context under which the process ran. Expand a process entry to view its command, credentials, and executable metadata. Expand an infrastructure entry to view resource-specific information, such as status, tags, security details, or related actions. Use the Show infrastructure entries toggle to show or hide the affected host, pod, and container. Use attributes such as executable path, arguments, PID, and user to filter for related Agent events. Select View in JSON on a process or activity entry to open the corresponding location in the raw event JSON. ### JSON{% #json %} The JSON tab displays the raw event payload with the complete set of event attributes collected by the Agent. Use JSON when you need the most detailed view of the event data, for example, to write advanced queries in the [Agent Events Explorer](https://app.datadoghq.com/security/agent-events), or share the full event payload during an investigation. To filter in and out any field, you can click on it from the JSON. ## Further reading{% #further-reading %} Additional helpful documentation, links, and articles: - [Explore Workload Protection detection rules](https://docs.datadoghq.com/security/workload_protection/detect_and_monitor/detection_and_finding_rules/detection_rules.md) - [Learn more about security notifications](https://docs.datadoghq.com/security/notifications.md)