UNKNOWN — 0 of 6 feeds current; dead: AWS CloudTrail, AWS Security Hub (GuardDuty, Inspector), Entra directory audits, Entra sign-ins, GCP audit logs, Office 365 audit. no events in this store. 15:24Z

0 of 3 platforms live. AWS, Microsoft and Google Cloud have never delivered. This store holds no events at all — nothing has been delivered and nothing replayed. Each feed against its own expected interval: 0 of 6 current; dead: AWS CloudTrail, AWS Security Hub (GuardDuty, Inspector), Entra directory audits, Entra sign-ins, GCP audit logs and Office 365 audit. Measured from soc.source_events at 2026-11-09T15:24Z. Provenance: UNKNOWN. This store holds no events at all, so there is nothing whose provenance could be established.

Agents

Past agent runs and the tools they used. Read-only.

Agents Investigations Performance Capacity

Runs—in this window, within the filters

Completed—finished with a result

Failed—failed or cancelled

Median duration—half the finished runs took less

Tool calls—through the runs’ grants

Past investigations

Loading…

Past agent runs, newest first. Enter on a row opens its tool calls.
Status	Started	Case	Playbook	Worker	Trigger	Verdict	Tool calls	Duration	Cost
Loading…

NightWatch

AgentsPast agent runs and the tools they used: what each investigation called, with what outcome and which credential. Read-only.

Past investigationsEvery agent run on the cases you may see, newest first. Tool calls are the calls a run made through its run grant (recorded since tool-call logging began; older runs show none). A run and its tool calls are kept as long as its case.

Agents

Past investigations