Monitoring Agent Behavior Overview
The agent behavior monitoring (ABM) dashboard's Agentic Overview page shows what AI tools are running across monitored systems in your enterprise. The Agent Overview page visualizes what hosts each tool is running on, how they are being used, which external systems an agent connects to, where the risks concentrate, historical trends, and when behavior deviates from that host’s established pattern. Refer to ABM Anomaly Detection.
The system locates AI tools, then groups them by host and tool to produce dashboard widgets. No new software or agents are installed, no network traffic is decrypted or inspected, and no endpoints are changed. Detected frameworks include:
- Cursor (IDE + Agent mode)
- Claude Code (CLI)
- Claude Desktop
While agent behavior monitoring can identify that a host contacted an AI service, it does not inspect prompts.
To view agent behavior monitoring:
- Connect an EDR or SIEM source.
- Go to Agentic Fabric > Agentic Overview > Agents.
- On the Agent Registry page, filter the Agents table by Source > CrowdStrike Falcon Data Replicator.
- Select any agent’s name to see details.
- Select the Behavior tab.
- Visualizations include sessions, tool calls, network events, MCP calls, timeline, and a process inventory that includes binary, path, and number of events.
In the various widgets, you can filter data and drill down with the filters intact. A last-updated timestamp indicates the last successful data refresh.
Note
Dashboard counts reflect the minimum, or lower bound, not a total of all activity.
ABM Anomaly Detection
Agent behavior monitoring (ABM) detects anomalous AI agent behavior based on each agent’s normal activity range, allowing you to quickly identify what needs attention. Go to Agentic Fabric > Non-Human Identities > Agents to view the ABM Anomaly Detection dashboard.
The Anomaly Detection page includes:
- Anomaly flag counts by detection metric
- Percentage of observations flagged
- Correlation against endpoint detection and response (EDR) alerts or multifactor authentication (MFA) failures
A risk severity rating is assigned to each anomaly flag to indicate the magnitude of deviation from normal baselines. When 5 or more metrics flag simultaneously for the same host, framework, or hour, this indicates a coordinated behavioral shift and receives a higher risk severity rating than the individual flags would ordinarily produce.
You can drill into which hosts and sessions triggered anomalies.
Anomaly Detection Data Metrics
Available types of anomaly metrics are listed below.
Volume Anomalies
Unexpected spikes in activity magnitude.
| Metric | What It Detects | Threat Model |
|---|---|---|
agent_sessions |
Unusual number of active sessions | Credential sharing, automated spawning, scripted attacks |
tool_calls |
Spike in high-risk tool invocations (curl, ssh, aws, kubectl) | Automated exfiltration, lateral movement, privilege abuse |
network_events |
Total event volume spike | Agentic loops gone rogue, DDoS participation, resource abuse |
mcp_calls |
MCP server communication burst | Tool abuse, malicious MCP server interaction |
Capability Escalation Anomalies
Agent acquiring or exercising new capabilities.
| Metric | What It Detects | Threat Model |
|---|---|---|
new_mcp_tools |
First-time MCP server connections | Malicious plugin installation, capability expansion |
process_type_diversity |
Variety of distinct binary types spawned | Tool discovery phase of attack, broadening access |
session_max_duration |
Sessions running longer than baseline | Unattended agents, persistent backdoors, slow exfiltration |
Entitlement Mismatch Anomalies
When an AI tool is observed running on an endpoint, but the agent's owner has no corresponding entitlement in SailPoint Human Fabric, this represents a governance gap. The user may be using a tool they have not been provisioned access to.
Caution
A missing entitlement can mean several things: the user is genuinely unauthorized, or the entitlement is provisioned through a system outside SailPoint Human Fabric's current scope. Because SailPoint cannot distinguish these cases from telemetry alone, it does not auto-escalate this signal. Instead, it surfaces the mismatch as a recommendation that an Admin reviews and either confirms (triggering a governance workflow) or dismisses (optionally noting the reason, such as "managed elsewhere").
| Metric | What It Detects | Threat Model |
|---|---|---|
missing_entitlement |
Agent's AI framework (e.g., Claude Code, Cursor, Copilot) has no matching entitlement in the owner's ISC access entitlement | Shadow AI usage, unauthorized tool adoption, provisioning drift |
Documentation Feedback
Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.