Guardrail Activity Detailed View

Overview

Guardrail Activity gives you a consolidated view of all security events detected by Akto’s Agentic Guardrails. You can review, investigate, and take action on guardrail violations raised by rule-based detection and anomaly detection mechanisms.

Navigate to Guardrail Activity

Follow these steps to access Guardrail Activity:

1. Log in to your Akto account.

2. Switch to the Agentic Security product.

3. From the left navigation bar, click Agentic Guardrails.

4. Select Guardrail Activity.

5. Scroll down to view the activity list, categorized as:

   • Active

   • Under Review

   • Ignored

   • Need Approval – events waiting on a reviewer decision for a Human Approval policy. See Manage Human Approval Requests.

6. Click any activity to open its detailed drilldown view.

Filters

Use filters to quickly narrow down relevant guardrail activities. The search box is located at the top-right corner of the activity list and supports filtering by:

• Actor

• URL

• Host

• Type

• Latest Attack Subcategory

Detailed View

The detailed view provides complete context required for investigation and remediation. The page displays severity along with all relevant metadata and is organised into three tabs:

Overview

Presents the description, details, and impact of the activity, giving you a clear understanding of the activity.

The tab also includes a Compliance section that maps the violation to the regulatory frameworks it affects, such as NIST 800-53, OWASP Agentic Skills Top 10, ISO 27001, and SOC 2, so you know which standards a detection impacts as it happens.

Timeline

Shows the chronological sequence of events related to the activity.

Values

Shows the attempted request and its response that helps validate exploit attempts and understand system behaviour.

You can copy the request in two formats:

• Curl

• Burp

Flagged response payloads are highlighted directly in the guardrail activity view, making it easier to spot and review violations at a glance.

Session Context

Displays the full session context surrounding the activity, helping you understand the broader sequence of interactions that led to the guardrail violation.

Remediation

Provides rule-specific remediation guidance tailored to the guardrail type that triggered the activity. Each remediation view includes:

• Immediate actions – Steps to take right away, such as identifying the exact rule violated and verifying whether the activity was intentional or a leak.

• Structural fixes – Long-term recommendations to address the root cause, such as enabling masking, implementing server-side redaction, using Anonymize mode, enforcing data minimisation, or initiating a compliance response.

Update the Status

Use Event Actions option to update the status of an activity:

• Mark for Review – Move the activity into the review workflow.

• Ignore – Remove the activity from the active guardrail list.

  

Once ignored, Akto will not flag the same actor and endpoint again based on the agentic guardrails that originally detected it.

Block the Traffic From the Source IP

Use Block IP button to immediately stop further activity from the malicious source.

For more details, continue to the Block an IP from Guardrail Activity Page.

Create Internal Workflow Item

You can create a Jira ticket or a Work Item directly from the guardrail activity view to support internal tracking, ticketing, and coordinated remediation.

To learn more about creating and configuring these items, head to the Create Internal Workflow Item.