Behavioral analysis

Baseline and anomaly detection on audit traffic

Content policies catch known text patterns. Behavioral analysis learns how your agents normally collaborate — volume, errors, graph shape, similarity — and alerts when the pattern deviates. Enabled automatically at tenant registration; alert-only.

Phase 1 — baseline & graph

• RPM / TPM / error spikes vs 7-day robust baselines
• Workflow fan-out, loop suspects, novel vendors, header coverage drops
• Realtime queue ingest plus hourly batch re-analysis

Phase 2 — similarity

• CPU hash embeddings (no GPU) on truncated request text from the ingest queue
• Near-duplicate bursts and cross-agent template abuse
• Centroid drift vs learned norms

Phase 3 — clustering

• Agent outliers, coordinated burst incidents, novel graph topology, hub emergence
• 14 catalog rules total across phases 1–3

MCP tools

audit_behavior_alert_catalog, audit_behavior_alert_summary, audit_behavior_alert_timeline, audit_behavior_full_report, and behavior sections inside audit_multi_agent_security_report.