--- title: Agent Events description: >- Search and analyze the runtime activity that the Datadog Agent sends to Datadog as Agent events. breadcrumbs: >- Docs > Datadog Security > Workload Protection > Investigate and Triage > Agent Events --- > For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt). # Agent Events The Datadog Agent evaluates system activity on the Agent host. When activity matches an Agent rule expression, the Agent generates an event and passes it to the Datadog backend. With the [Agent Events Explorer](https://app.datadoghq.com/security/agent-events), you can investigate Agent events separately from signals. Review what happened, where it occurred, and which Agent rule matched using the event side panel. You can also explore the investigation graph, process tree, and raw JSON payload, and view triage and response instructions for the matching rule. ## Investigate Agent events{% #investigate-agent-events %} To investigate an Agent event: 1. Go to the [Agent Events Explorer](https://app.datadoghq.com/security/agent-events). Agent events are queried and displayed using the standard explorer controls in the Datadog [Events Explorer](https://docs.datadoghq.com/events/explorer.md). 1. Select an Agent event. The side panel opens with tabs that help you investigate the event. ### Overview{% #overview %} The Overview tab summarizes the event and is often the best place to start your investigation. {% image source="https://docs.dd-static.net/images/security/workload_protection/investigate_and_triage/agent_events/agent_event_overview.bee712ef152a713efdc8559181d02026.png?auto=format&fit=max&w=850 1x, https://docs.dd-static.net/images/security/workload_protection/investigate_and_triage/agent_events/agent_event_overview.bee712ef152a713efdc8559181d02026.png?auto=format&fit=max&w=850&dpr=2 2x" alt="Agent event side panel Overview tab showing What, Where, Agent rule, and Investigation graph sections" /%} The Overview tab includes the following sections: - What: A human-readable description of the detected activity. For example, *A user executed the clang command on host i-0d85f97942d947ca9*. - Where: The infrastructure context where the event occurred, including cloud provider, account, region, host, Kubernetes cluster, namespace, pod, container, and image. - Agent rule: The Agent rule that matched the event, including the rule name, event name, deployment policies, policy version, and rule expression. - Investigation graph: A preview of the investigation graph at the bottom of the Overview tab. - Process tree: The complete process lineage from the system init process to the process that triggered the event. #### Investigation graph{% #investigation-graph %} The Investigation graph is an interactive visualization that maps the infrastructure and processes involved in the event. It provides a compact overview of the attack chain by highlighting the most relevant entities and processes. {% image source="https://docs.dd-static.net/images/security/workload_protection/investigate_and_triage/agent_events/agent_event_investigation_graph.ad5f58b9c777f6962aab5f25ecdc4e84.png?auto=format&fit=max&w=850 1x, https://docs.dd-static.net/images/security/workload_protection/investigate_and_triage/agent_events/agent_event_investigation_graph.ad5f58b9c777f6962aab5f25ecdc4e84.png?auto=format&fit=max&w=850&dpr=2 2x" alt="Investigation graph showing host, Kubernetes pod, container, image, and main process execution path" /%} The graph traces the event from the host through the surrounding infrastructure—such as the Kubernetes pod, replica set, container, and container image—and into the process execution path. Main processes involved in the event are displayed individually, while less relevant processes are aggregated into grouped nodes (for example, **+7 processes**) to keep the view focused on the suspicious activity. Use the investigation graph to understand how the detected activity fits into the broader runtime context without reviewing every process on the host. #### Process tree{% #process-tree %} The Process tree lists the complete process lineage from the system init process to the process that triggered the event. {% image source="https://docs.dd-static.net/images/security/workload_protection/investigate_and_triage/agent_events/agent_event_process_tree.319e1b655e4921ca45a82a4025b0a8df.png?auto=format&fit=max&w=850 1x, https://docs.dd-static.net/images/security/workload_protection/investigate_and_triage/agent_events/agent_event_process_tree.319e1b655e4921ca45a82a4025b0a8df.png?auto=format&fit=max&w=850&dpr=2 2x" alt="Process tree listing the full process chain from systemd to the process that triggered the event" /%} For each process in the chain, the process tree displays: - Path: The executable path and command-line arguments. - PID: The process ID. - PPID: The parent process ID. - User: The user context under which the process ran. The process tree shows the full ancestry of the event, starting from `systemd` and continuing through intermediate processes—such as `containerd`, `runc`, and workload-specific processes—down to the command that matched the Agent rule. This helps you reconstruct the exact execution path that led to the detection. ### JSON{% #json %} The JSON tab displays the raw event payload with the complete set of event attributes collected by the Agent. Use JSON when you need the most detailed view of the event data, for example, to write advanced queries in the [Agent Events Explorer](https://app.datadoghq.com/security/agent-events), or share the full event payload during an investigation. To filter in and out any field, you can click on it from the JSON. ## Further reading{% #further-reading %} Additional helpful documentation, links, and articles: - [Explore Workload Protection detection rules](https://docs.datadoghq.com/security/workload_protection/detect_and_monitor/detection_and_finding_rules/detection_rules.md) - [Learn more about security notifications](https://docs.datadoghq.com/security/notifications.md)