---
title: "Security & IR · Ataris"
description: "When an agent does something it shouldn't, Ataris shows the instruction that set it off, every resource it touched, and which connections actually left your environment."
canonical: "https://ataris.dev/solutions/security"
last-updated: 2026-10-10
---
# Investigate agent incidents with evidence.

When an agent does something it shouldn't, Ataris shows the instruction that set it off, every resource it touched, and which connections actually left your environment.

## From alert to answer

1. **Find the session.** Every run carries its tags and mission, and events are flagged for credential access, suspected prompt injection, and outbound traffic.
2. **Follow the cause.** Trace a suspicious action back through its causal links to the context that triggered it, including an instruction hidden in a README or a fetched page.
3. **Scope the exposure.** See which credentials and sensitive files the agent read, which skills it loaded and MCP tools it called, and which connections went out, were blocked, or raised an alert.
4. **Close the gap.** On Pro and above, write a policy that blocks the tool calls involved and alerts on the paths and hosts, and target it at the agent's future sessions by tag.

## What security teams get

- **More than the agent reports.** Processes, file opens, and network connections are recorded directly, so what a script the agent ran actually did is on the record, not just the tool call that started it.
- **Credential reads that stand out.** Resources are marked normal, sensitive, or credential, so a read of ~/.ssh or a .env file is easy to find on a busy timeline.
- **Reads kept apart from what left.** File reads and outbound connections are separate events on separate lanes, so you can tell what the agent saw from what it sent.
- **Tool calls you control.** On Pro and above, block rules refuse a matching command, file access, web fetch, MCP tool, or skill before it runs. Every blocked attempt is recorded on the timeline with the rule that stopped it.

## Common questions

### Does the evidence rely on what the agent reports?

No. Ataris records processes, files, and connections directly, not just the tool calls the agent reports, so a command's side effects are recorded even if the agent never mentions them.

### Does Ataris stop an attack in progress?

On Pro and above, the CLI refuses any tool call your policy blocks before it runs. Activity underneath a tool call, such as a connection a script opens, is checked against the same rules and raises alerts, but isn't stopped.

### Can we tell which skill or MCP server was involved?

Yes. Each run lists the skills the agent loaded and the MCP servers and tools it called, and each call sits on the timeline next to what the agent did after it. When a skill reads a credential or an MCP tool sends data out, you can see which one it was.

### How do we spot prompt injection?

Events can be flagged as suspected injection, and context links show which content entered the model's context before the decision that followed.

## Be ready for your first agent incident.

Book a demo and we'll reconstruct an incident with your security team.

[Book a demo](https://ataris.dev/contact) · [Read the docs](https://ataris.dev/docs/concepts/trace-events.md)