Agent Events

The Datadog Agent evaluates system activity on the Agent host. When activity matches an Agent rule expression, the Agent generates an event and passes it to the Datadog backend.

With the Agent Events Explorer, you can investigate Agent events separately from signals. Review what happened, where it occurred, and which Agent rule matched using the event side panel. You can also explore the investigation graph, process tree, and raw JSON payload, and view triage and response instructions for the matching rule.

Investigate Agent events

To investigate an Agent event:

  1. Go to the Agent Events Explorer. Agent events are queried and displayed using the standard explorer controls in the Datadog Events Explorer.
  2. Select an Agent event. The side panel opens with tabs that help you investigate the event.

Overview

The Overview tab summarizes the event and is often the best place to start your investigation.

Agent event side panel Overview tab showing What, Where, Agent rule, and Investigation graph sections

The Overview tab includes the following sections:

  • What: A human-readable description of the detected activity. For example, A user executed the clang command on host i-0d85f97942d947ca9.
  • Where: The infrastructure context where the event occurred, including cloud provider, account, region, host, Kubernetes cluster, namespace, pod, container, and image.
  • Agent rule: The Agent rule that matched the event, including the rule name, event name, deployment policies, policy version, and rule expression.
  • Investigation graph: A preview of the investigation graph at the bottom of the Overview tab.
  • Process tree: The complete process lineage from the system init process to the process that triggered the event.

Investigation graph

The Investigation graph is an interactive visualization that maps the infrastructure and processes involved in the event. It provides a compact overview of the attack chain by highlighting the most relevant entities and processes.

Investigation graph showing host, Kubernetes pod, container, image, and main process execution path

The graph traces the event from the host through the surrounding infrastructure—such as the Kubernetes pod, replica set, container, and container image—and into the process execution path. Main processes involved in the event are displayed individually, while less relevant processes are aggregated into grouped nodes (for example, +7 processes) to keep the view focused on the suspicious activity.

Use the investigation graph to understand how the detected activity fits into the broader runtime context without reviewing every process on the host.

Process tree

The Process tree lists the complete process lineage from the system init process to the process that triggered the event.

Process tree listing the full process chain from systemd to the process that triggered the event

For each process in the chain, the process tree displays:

  • Path: The executable path and command-line arguments.
  • PID: The process ID.
  • PPID: The parent process ID.
  • User: The user context under which the process ran.

The process tree shows the full ancestry of the event, starting from systemd and continuing through intermediate processes—such as containerd, runc, and workload-specific processes—down to the command that matched the Agent rule. This helps you reconstruct the exact execution path that led to the detection.

JSON

The JSON tab displays the raw event payload with the complete set of event attributes collected by the Agent. Use JSON when you need the most detailed view of the event data, for example, to write advanced queries in the Agent Events Explorer, or share the full event payload during an investigation. To filter in and out any field, you can click on it from the JSON.

Further reading

Additional helpful documentation, links, and articles:

Explore Workload Protection detection rulesDOCUMENTATION more more Learn more about security notificationsDOCUMENTATION more more