AI Agent Events
Overview
Section titled “Overview”Evidence: AI Agent Events
Description: Parse AI agent transcripts to extract a hash-chained event timeline
Category: AI
Platform: macos
Short Name: aievt
Is Parsed: Yes
Sent to Investigation Hub: Yes
Collect File(s): No
Background
Section titled “Background”AI coding assistants and agent frameworks persist prompts, tool calls, approvals, and execution results in JSONL or JSON transcripts. Those records show what an agent was asked to do, which tools it invoked, and whether a user approved the action.
Data Collected
Section titled “Data Collected”This collector gathers structured data about AI agent events, including prompts, assistant messages, tool calls, MCP server names, approval states, exit codes, and source hashes.
Collection Method
Section titled “Collection Method”Transcripts from AI tools are parsed with explicit size limits. Each event is hash-chained using the previous hash and source offset so analysts can detect gaps or tampering. Prompt text is stored as a bounded redacted excerpt with SHA-256.
Forensic Value
Section titled “Forensic Value”Reconstructs what an AI agent did on the host: which commands it ran, which files it referenced, which MCP tools it called, and whether the user approved or denied those actions. Risk flags highlight prompt injection, dangerous commands, credential access, and transcript integrity gaps.