What Happens When Your
AI Agent Goes Rogue
See how Correlic monitors AI agent activity from the kernel up — capturing every process, file access, and network connection, then surfacing threats with autonomous AI investigation.
How AI Agent Activity Is Monitored
Scroll through each stage to see how Correlic captures, analyzes, and responds to everything your AI agents do.
Where It All Starts
Kernel Collection
When an AI agent like Cursor, Claude Code, or Copilot performs any action on your system, Correlic captures it directly at the kernel level — before the agent even knows it's being watched.
Knowing Which Agent Did What
Session & PID Tracking
Every AI agent process is assigned a unique session UUID that automatically inherits from parent to child — building a complete lineage tree so Correlic knows exactly which agent spawned which process.
Keep What Matters, Drop What Doesn't
Intelligent Sampling
Not every event is worth storing. Correlic's security-first sampling pipeline ensures AI agent activity is never filtered, suspicious patterns are always kept, and routine noise is intelligently removed.
The Heart of Correlic
Correlation Engine
This is what Correlic is named for — correlation at the core. Every event is mapped by agent session and process ID, building a live relationship graph that connects everything an AI agent touches.
Purpose-Built for AI Agent Threats
Threat Detection
Every detection rule gates on AI process attribution first — system daemons and human activity never trigger false positives. Rules are designed for the specific ways AI agents go rogue.
Learning What's Normal
Behavioral Engine
Correlic continuously observes what your AI agents normally do and learns to suppress expected behavior — while ensuring that access to sensitive resources always generates a finding.
Every Detection, Actionable
Findings & Triage
Each threat detection generates a structured finding with severity, confidence, context, and MITRE technique mapping. Users can allow, dismiss, or investigate each finding — and their decisions feed back into the behavioral engine.
Connecting the Dots
Chain Correlation
A single finding is a data point. A chain of findings is evidence. Correlic links individual detections into multi-step attack sequences — because AI agents can perform complex attack patterns faster than any human.
From Findings to Action
Incident Engine
Findings are grouped by host and agent session into coherent incidents with full lifecycle management. Each incident gets a structured dossier — the foundation for AI-powered investigation.
Evidence-Based, Never Assumed
AI Analysis
Correlic builds detailed context windows at every time scale — from 1-minute snapshots to yearly summaries. Raw events are periodically cleaned without affecting analysis, because the context windows preserve full intelligence. This is what makes Correlic capable of detecting long-term threats that other tools miss.
The Right Alert, to the Right Place
Alerts & Response
Every finding generates an in-app notification for full audit trail. Incidents are delivered externally via Slack or webhook — severity-gated and cryptographically signed.
End-to-end latency under 100ms from kernel event to stored finding