Risk Library

A risk finding identifies a pattern worth reviewing in captured agent activity. This library explains the possible harm, gives a fictional example, and describes what each associated rule can and cannot establish.

Find an explanation

Browse the categories below, or use the rule index when you have a rule ID from an event. Several rules can point to the same risk type. Library categories group related topics; the exact event category values are preserved in the rule tables.

• Credentials and sensitive data
• Data movement
• Supply chain and agent configuration
• Dangerous commands and execution
• Network destinations
• Persistence and automatic execution
• Security controls and monitoring
• Workspace boundaries
• Resource consumption
• Cryptocurrency wallets and keys
• Database input validation

Read a finding in context

Check the original tool call, the task the user authorized, and the tool result. An invocation can describe an attempted action even if permission was denied or the tool failed. A path or text match may be a reference to an action rather than evidence that it happened.

Severity indicates the rule’s assessment of potential risk. It does not measure certainty, and even a CRITICAL finding needs context. Several findings may describe the same call from different perspectives.

False positives and false negatives

A false positive is an alert on activity that is legitimate or does not involve the risk being investigated. Authorized setup work can resemble an attack, and text or path heuristics can match an example or reference.

A false negative is risky activity that a rule misses. Unsupported patterns, missing capture, indirect subprocess actions, and activity outside a rule’s scope can all cause misses. An absence of findings does not establish safety. Each risk page gives more specific examples of both limitations.

The examples in this library are fictional. Where a public incident or technique is referenced, it illustrates a risk pattern; it does not mean Omnodex can identify that incident or detect every part of its attack chain.

Rule availability

Community rules are included with Omnodex. Advanced rules require an entitled plan and a loaded advanced rule bundle. The rules and versions actually loaded by your installation determine which findings can appear. See running detection and tiers and plans.