AsrielNetworks continuously monitors your AI applications and agents, detects attacks and abnormal behaviour in their traces, correlates activity into security incidents, and helps you respond before damage is done. One console, one tenant-isolated data model, twelve deterministic rules over every trace.
Three parts of one console, each fed by the same telemetry and the same detection engine.
Every agent is a first-class entity with memory, permissions, tools, autonomy and a behaviour history. Models, deployments, MCP servers and retrieval corpora are inventory, not log lines.
Prompts, retrievals, tool calls and responses arrive as ordered traces. Twelve code-backed rules evaluate each event with its trace window, inline in the request path or on a queue.
Findings that share a trace, session or agent become one incident with a risk score, a narrative, the attack path, sealed evidence and a response plan derived from the rules that fired.
Every sign-in, API key and agent check-in, placed on the map. A credential that appears from a new country, or from two places one journey apart, is flagged before anyone has to notice.
One tenant's data moves through these stages. Storage is PostgreSQL with row-level security forced on every tenant table; the application role cannot bypass it.
Your agent, LLM app or MCP host, instrumented with the SDK or routed through the gateway.
Schema validation, allow-listed identifiers, sequence and trace binding, per-credential rate limits.
AsrielNetworksPOST /api/v1/ingest/events batchesSessions and traces as ordered events, each with kind, title, redaction state and structured data.
Every detector sees the current event, the trace window and recent security events. Inline or queued.
Findings become incidents with a risk score, narrative, path nodes and evidence; repeat signals attach rather than duplicate.
Role checks, plan gates and step-up on sensitive actions sit on every route; the consoles call nothing the API does not expose.
Requests to /gateway/v1 enter at stage 3 as prompt events after the proxy call, so an inline deployment and an SDK deployment produce the same trace shape and are detected by the same rules.
Tenant isolation is a database property (RLS keyed on a per-transaction session setting), not a query convention. Credentials are stored as SHA-256 hashes; rotation issues a replacement and revokes the original at once. Sensitive actions require a fresh second factor.
The console's signature panel. Traffic flows through retrieval, the model, tools and the database; a blocked call dies at the stage that stopped it.
Each rule is code, versioned and tenant-configurable, and names the event types it listens to. The concept pages in Learn explain the attack each one targets.
| Rule | Detects | Category | Severity | Learn |
|---|---|---|---|---|
ai.prompt_injection.direct |
Direct prompt injection Structured injection verdicts and deterministic instruction-override signals in received or scanned prompts. |
prompt injection | high | Concept |
ai.prompt_injection.indirect |
Indirect prompt injection Untrusted retrieved instructions correlated with a later sensitive tool proposal in the same trace. |
prompt injection | high | Concept |
ai.tool.unauthorized |
Unauthorized tool use Tools outside the agent's grants, policy-denied proposals, and execution after a denial. |
excessive agency | high | Concept |
ai.data.sensitive_exposure |
Sensitive data exposure Scanner and policy signals on outputs and transfers, evaluated without storing the raw values. |
data access abuse | high | Concept |
ai.rag.poisoning |
RAG poisoning or contamination A suspicious retrieved document, distinguished from confirmed influence over a risky action. |
supply chain | medium | Concept |
ai.intent_action.divergence |
Intent-action divergence Declared task category compared with the explicit tool category and side effects. |
causal hijack | high | Concept |
ai.action.concealment_risk |
Concealed action risk A benign final status that omits risky or blocked effects recorded earlier in the trace. |
causal hijack | medium | Concept |
ai.control.repeated_failure |
Repeated security control failure Repeated policy denials or guardrail failures aggregated over a bounded window (3 in 60 minutes by default). |
excessive agency | high | Concept |
ai.tool.risk_misdeclared |
Tool risk declared below its inferred class A tool call declared a category or governance class below what its name implies; declarations can escalate, never downgrade. |
excessive agency | medium | Concept |
ai.mcp.tool_poisoning |
MCP tool poisoning Model-directed instructions inside an MCP tool description, or a description that changed between sightings in one trace. |
supply chain | high | Concept |
ai.mcp.approval_bypass |
Privileged tool call bypassed its gate A destructive- or secrets-class tool executed with no broker decision in a trace where other calls were gated. |
excessive agency | high | Concept |
ai.mcp.tool_shadowing |
MCP tool name collision Two MCP servers exposed or served the same tool name inside one execution trace. |
supply chain | medium | Concept |
Pick the one that matches where your agent runs. All three produce the same trace shape.
Send asrielnetworks.ai.event.v1 batches with a machine credential in X-API-Key. Twenty-odd event types; this one is a denied tool call that opens an incident on its own.
{
"schema_version": "1.0",
"event_id": "evt_01j8x2",
"event_type": "tool.denied",
"timestamp": "2026-09-19T09:41:07Z",
"trace_id": "t-4f2a9c",
"session_id": "sess_t-4f2a9c",
"sequence": 7,
"application": { "external_id": "support-copilot" },
"agent": { "external_id": "triage-agent" },
"data": { "tool": "records.drop_table", "reason": "outside_scope" },
"security": { "trust_level": "trusted", "policy_decision": "deny" }
}Register a provider and a deployment in the console, then change one base URL. The key carries a gateway:use scope.
curl https://<your-host>/gateway/v1/chat/completions \
-H "X-API-Key: siq_…" \
-H "Content-Type: application/json" \
-d '{"model": "support-copilot-prod", "messages": [...]}'For hosts without the SDK: single prompt, tool and response events on /api/v1/telemetry/events, same credential model, same detection.
Monitoring, alerts and notifications, with every built-in rule. Sign-up creates your organization; nothing to install until you decide how to connect.