Risk Detection
Omnodex evaluates captured agent events against declarative detection rules and writes findings as risk events. A finding identifies behavior worth reviewing in context; it does not by itself establish a vulnerability, breach, or completed action.
For the meaning of a specific finding, browse the Risk Library or look up its rule ID in the rule index.
How rules work
Section titled “How rules work”Each rule defines the event types and conditions it matches, a base severity, an event category, and a description. Conditions in a rule must all match. Community rules include single-call patterns, session tool-call rate thresholds, and first-observed MCP server use.
Rules inspect the activity captured by the integration. They do not provide complete visibility into every filesystem operation, network packet, or subprocess action. Some findings use path and text heuristics, so a reference in a tool call can trigger without the corresponding action succeeding.
Categories and explanations
Section titled “Categories and explanations”The Risk Library groups related findings into readable categories. Its rule tables retain the exact event category values and map each built-in rule to a risk type. Multiple rules can share an explanation, such as execution and configuration patterns associated with sandbox changes.
Each risk page explains the potential harm, a fictional example, the matching behavior, practical next steps, and possible false positives and false negatives.
Risk levels
Section titled “Risk levels”| Level | How to interpret it |
|---|---|
| CRITICAL | Potential for severe harm, such as credential transmission or remote shell access; review promptly. |
| HIGH | Significant potential harm or a sensitive operation that warrants close review. |
| MEDIUM | Behavior that needs context, such as exposed credential-like text or an unusual install pattern. |
| LOW | Contextual information, such as first-observed MCP server use, that may be expected. |
Severity reflects potential risk rather than certainty. The level comes from the matching rule and may be lower when a command pattern is saved for later execution rather than invoked directly. Some rules retain their base severity for staged changes.
Community and advanced rules
Section titled “Community and advanced rules”Community rules are included with Omnodex, cover general-purpose patterns, and are open source. Advanced rules are an Omnodex-maintained rule set for paid plans, with deeper analysis than the community rules, tuned against real agent activity and updated as new techniques appear. Which advanced findings can appear depends on your plan and the rule bundle your installation has loaded. Advanced rules that follow data across several calls attach evidence to each finding, and the hosted dashboard groups the findings about one chain into an investigation. The local dashboard and CLI show only how many advanced findings there are.
Next steps
Section titled “Next steps”- Risk Library - Understand a finding and its limitations.
- Running detection - Run the analyzer.
- Tiers and plans - Check plan availability.