> For the complete documentation index, see [llms.txt](https://ai-security-docs.akto.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ai-security-docs.akto.io/agentic-guardrails/how-to/guardrail-activity-detailed-view.md).

# Guardrail Activity Detailed View

## Overview

Guardrail Activity gives you a consolidated view of all security events detected by Akto’s Agentic Guardrails. You can review, investigate, and take action on guardrail violations raised by rule-based detection and anomaly detection mechanisms.

## Navigate to Guardrail Activity

Follow these steps to access Guardrail Activity:

1. Log in to your Akto account.
2. Switch to the **Agentic Security** product.
3. From the left navigation bar, click **Agentic Guardrails**.
4. Select **Guardrail Activity**.
5. Scroll down to view the activity list, categorized as:
   * **Active**
   * **Under Review**
   * **Ignored**
   * **Need Approval** – events waiting on a reviewer decision for a **Human Approval** policy. See [Manage Human Approval Requests](/agentic-guardrails/how-to/manage-human-approval-requests.md).
6. Click any activity to open its detailed drilldown view.

{% hint style="success" %}
**Filters**

Use filters to quickly narrow down relevant guardrail activities. The search box is located at the top-right corner of the activity list and supports filtering by:

* Actor
* URL
* Host
* Type
* Latest Attack Subcategory
  {% endhint %}

## Detailed View

The detailed view provides complete context required for investigation and remediation. The page displays severity along with all relevant metadata and is organised into three tabs:

{% tabs %}
{% tab title="Overview" %}
Presents the **description**, **details**, and **impact** of the activity, giving you a clear understanding of the activity.

The tab also includes a **Compliance** section that maps the violation to the regulatory frameworks it affects, such as **NIST 800-53**, **OWASP Agentic Skills Top 10**, **ISO 27001**, and **SOC 2**, so you know which standards a detection impacts as it happens.

<figure><img src="/files/21BGNK8qKTZfN8TqjKj9" alt="" width="563"><figcaption></figcaption></figure>
{% endtab %}

{% tab title="Timeline" %}
Shows the chronological sequence of events related to the activity.

<figure><img src="/files/tXr79gaXk39tyXGGq8EO" alt="" width="563"><figcaption></figcaption></figure>
{% endtab %}

{% tab title="Values" %}
Shows the **attempted request** and its **response** that helps validate exploit attempts and understand system behaviour.

<figure><img src="/files/WmZ88k00WLQkuMW9Kzqz" alt="" width="375"><figcaption></figcaption></figure>

You can copy the request in two formats:

* **Curl**
* **Burp**

Flagged response payloads are highlighted directly in the guardrail activity view, making it easier to spot and review violations at a glance.
{% endtab %}

{% tab title="Session Context" %}
Displays the full session context surrounding the activity, helping you understand the broader sequence of interactions that led to the guardrail violation.
{% endtab %}

{% tab title="Remediation" %}
Provides **rule-specific remediation guidance** tailored to the guardrail type that triggered the activity. Each remediation view includes:

* **Immediate actions** – Steps to take right away, such as identifying the exact rule violated and verifying whether the activity was intentional or a leak.
* **Structural fixes** – Long-term recommendations to address the root cause, such as enabling masking, implementing server-side redaction, using Anonymize mode, enforcing data minimisation, or initiating a compliance response.
  {% endtab %}
  {% endtabs %}

### **Update the Status**

Use **Event Actions** option to update the status of an activity:

* **Mark for Review** – Move the activity into the review workflow.
* **Ignore** – Remove the activity from the active guardrail list.

  <figure><img src="/files/Mk4LAfpgpeIFFam30sor" alt="" width="563"><figcaption></figcaption></figure>

{% hint style="warning" %}
Once ignored, Akto will **not flag the same actor and endpoint again** based on the agentic guardrails that originally detected it.
{% endhint %}

### Block the Traffic From the Source IP

Use **Block IP** button to immediately stop further activity from the malicious source.

For more details, continue to the [Take Action on Guardrails Events](/agentic-guardrails/how-to/take-action-on-guardrails-events.md#block-an-ip-from-guardrail-activity-page).

### Create Internal Workflow Item

You can create a **Jira ticket** or a **Work Item** directly from the guardrail activity view to support internal tracking, ticketing, and coordinated remediation.

To learn more about creating and configuring these items, head to the [Create Internal Workflow Item](/agentic-guardrails/how-to/create-internal-workflow-item.md)**.**