Observe

DeepTracing
Session-Level Full Observability

Unified collection of six core events. Every alert traces back to the complete session Trace, not just process or network 5-tuple.

Six Core Event Types

Semantic-level observation over system calls, avoiding traditional EDR-style high-noise data.

Tool name, call chain, execution duration, success/error status

ReadFile → src/config/db.ts (23ms)

Decision result (allow/ask/deny), policy source, rule ID

deny → BashExec (rule: no-shell-in-prod)

Model provider, model name, reasoning mode, token budget

claude-4-sonnet · reasoning=extended

Operation type, masked path, sensitive path flag, scope

read → *.env (sensitive=true, scope=out)

Direction, masked target, protocol, request/response size

egress → api.openai.com:443 (https)

Service name, transport protocol, tool name, auth status

github-mcp → ListPRs (stdio, authed)

Each event carries traceId / sessionId / spanId for automatic cross-event correlation.

{

"kind": "aidr.event",

"schemaVersion": "1.0.0",

"type": "tool_call",

"trace": {

"traceId": "trace-7f3a...",

"sessionId": "sess-ab12...",

"spanId": "span-001"

"tenant": { org_id, project_id, environment },

"risk": { "score": 72, "labels": ["sensitive-path"] }

}