Security Finding Catalog

Reference

Each finding type in Nirmata AIControls has a plain-English title, a short reason it matters, a recommended action, and a mapping to MITRE ATLAS and ATT&CK techniques. The Security page shows these on incident rows, in the incident drawer and in the All findings list.

How to read this catalog

• Mapping names the MITRE technique a finding is evidence of or defends against. ATLAS techniques use IDs like AML.T0051; ATT&CK techniques use IDs like T1048.
• None means no technique fits. The reason is given. A blocked call, a governance step or an inventory gap shows that a control acted or a gap exists, not which technique an adversary used.
• A mapping is a pointer for triage and reporting. It does not mean an attack took place.

API fields

GET /api/v1/security-incidents, GET /api/v1/security-incidents/{id} and the finding routes (GET /api/v1/security-findings, including each member finding of an incident) carry a knowledge object, or null for an event type this catalog does not list:

Field	Meaning
key	Catalog key, such as attack_pattern:bulk-read-egress or content_safety_finding:aws_key.
title	Plain-English name.
why	Why the finding matters.
action	Recommended action.
techniques	List of framework (ATLAS or ATT&CK), id, name and url. Empty when there is no mapping.
mappingNote	Why there is no mapping; empty when techniques is not empty.

An incident resolves to the most specific entry known for its pattern: the attack-pattern template, content type, anomaly kind or baseline metric. A finding in the flat list, including each member of an incident, resolves from its content type, attack-pattern template, anomaly kind or baseline metric, and otherwise to the entry for its event type.

Gateway decisions and governance

Policy decisions, human approvals and exceptions recorded by the gateway.

Finding	Why it matters	Recommended action	MITRE mapping
Call blocked by policy policy_denial	A policy denied a tool or model call before it ran. The control worked, but the caller attempted something your rules forbid.	Open the evidence to see who tried what. Repeated denials from one actor can mean misconfiguration or probing; adjust the policy or contact the owner.	None. A denial records that a control blocked a call. It does not say which technique the caller attempted.
Call flagged by an audit-mode policy policy_audit	A policy named like one of the intent policies recorded this call in Audit mode, so it was not blocked. The recorded name does not prove the policy is a built-in one or that the agent departed from its declared purpose.	Open the evidence to see which policy matched and why. If this behavior should be stopped, change the policy's action to Enforce.	None. Audit-mode findings record the decision, not a verified technique.
Outbound network request blocked egress_denied	A request to an external destination was stopped by network egress rules. Outbound blocks are where data would leave your environment.	Check the destination and the caller. If the destination is legitimate, add it to the egress allowlist; otherwise investigate the workload or agent.	None. A blocked outbound request shows a control worked. It does not show the destination was an exfiltration channel or which technique was attempted.
Call held for human approval approval_required	A policy held a call until a reviewer decides. Until then the action has not run.	Approve or deny the request in Approvals. Unattended holds delay the agent.	None. This records a governance decision or lifecycle step. It describes how a control responded, not an adversary technique.
Response blocked before delivery response_blocked	A tool or model response matched a response policy and was withheld. It may have carried sensitive data or injected instructions.	Inspect the evidence for what the response contained and which upstream produced it. Tighten or allow the source as appropriate.	None. The block records that a response policy matched, not what the response contained, so no single technique applies.
Policy exception requested exception_requested	Someone asked to bypass a policy for a scope and time. Exceptions weaken a control, so each one needs an owner and an expiry.	Review the justification, scope and duration, then grant or deny it.	None. This records a governance decision or lifecycle step. It describes how a control responded, not an adversary technique.
Policy exception granted exception_granted	A policy exception is now in effect and matching calls are allowed through. Exceptions should be rare and short-lived.	Confirm the exception is still needed and has an expiry. Revoke it when the work is done.	None. This records a governance decision or lifecycle step. It describes how a control responded, not an adversary technique.
Policy exception denied exception_denied	A request to bypass a policy was refused. The requester remains blocked by the policy.	No action is required unless the requester has a valid need; point them to the approved path.	None. This records a governance decision or lifecycle step. It describes how a control responded, not an adversary technique.
Policy exception revoked exception_revoked	An active exception was withdrawn before its expiry, so the policy applies again.	Confirm affected workloads or agents still work as intended.	None. This records a governance decision or lifecycle step. It describes how a control responded, not an adversary technique.
Policy exception expired exception_expired	An exception reached its end time and the policy applies again.	If the work continues, request a new exception or update the policy.	None. This records a governance decision or lifecycle step. It describes how a control responded, not an adversary technique.
Held call approved by a reviewer hitl_approved	A reviewer allowed a call that a policy had held. It is a human governance decision, not a policy denial.	No action is required. Review the approval if the reviewer or scope is unexpected.	None. This records a governance decision or lifecycle step. It describes how a control responded, not an adversary technique.
Held call denied by a reviewer hitl_denied	A reviewer refused a call that a policy had held, so it did not run.	No action is required. Follow up with the caller if the request looks malicious.	None. This records a governance decision or lifecycle step. It describes how a control responded, not an adversary technique.

Content safety

Findings from the content scanners. The type is the detector's finding type; an unrecognized type shows the general entry.

Finding	Why it matters	Recommended action	MITRE mapping
Sensitive or unsafe content detected content_safety_finding	A content scanner flagged text in a prompt, tool argument or response. The finding type tells you whether it is a secret, personal data, an injection attempt or unsafe content.	Open the evidence to see the finding type and the redacted sample, then decide whether to redact, block or allow it.	None. Content findings come from several detectors with their own type names. This entry covers a type that has no specific entry, so no single technique applies.
Unsafe content flagged by Llama Guard content_safety_finding:llamaguard	The Llama Guard model flagged a prompt or response in a harm category such as violence or hate. These categories describe content safety, not an attack technique.	Open the evidence to see the category and decide whether to block or allow it.	None. Llama Guard categories describe harmful content, not an adversary technique.
Personal data detected by Presidio content_safety_finding:presidio	The Presidio recognizer found personal data in AI traffic. Personal data sent to a model or tool may leave your control and can create privacy and compliance exposure.	Confirm the data was meant to be shared. Enable redaction or blocking for this type if it was not.	ATLAS AML.T0057 LLM Data Leakage
Private key in AI traffic content_safety_finding:private_key	A private key appeared in AI traffic. A credential sent to a model or tool can be stored, logged or reused by whoever receives it.	Rotate the credential if it is real, and find out how it reached the prompt or tool call. Enable redaction or blocking for this type.	ATLAS AML.T0055 Unsecured Credentials ATT&CK T1552 Unsecured Credentials
AWS access key in AI traffic content_safety_finding:aws_key	An AWS access key appeared in AI traffic. A credential sent to a model or tool can be stored, logged or reused by whoever receives it.	Rotate the credential if it is real, and find out how it reached the prompt or tool call. Enable redaction or blocking for this type.	ATLAS AML.T0055 Unsecured Credentials ATT&CK T1552 Unsecured Credentials
GitHub token in AI traffic content_safety_finding:github_token	A GitHub token appeared in AI traffic. A credential sent to a model or tool can be stored, logged or reused by whoever receives it.	Rotate the credential if it is real, and find out how it reached the prompt or tool call. Enable redaction or blocking for this type.	ATLAS AML.T0055 Unsecured Credentials ATT&CK T1552 Unsecured Credentials
Slack token in AI traffic content_safety_finding:slack_token	A Slack token appeared in AI traffic. A credential sent to a model or tool can be stored, logged or reused by whoever receives it.	Rotate the credential if it is real, and find out how it reached the prompt or tool call. Enable redaction or blocking for this type.	ATLAS AML.T0055 Unsecured Credentials ATT&CK T1552 Unsecured Credentials
API key in AI traffic content_safety_finding:api_key	An API key appeared in AI traffic. A credential sent to a model or tool can be stored, logged or reused by whoever receives it.	Rotate the credential if it is real, and find out how it reached the prompt or tool call. Enable redaction or blocking for this type.	ATLAS AML.T0055 Unsecured Credentials ATT&CK T1552 Unsecured Credentials
Connection string in AI traffic content_safety_finding:connection_string	A database or service connection string appeared in AI traffic. A credential sent to a model or tool can be stored, logged or reused by whoever receives it.	Rotate the credential if it is real, and find out how it reached the prompt or tool call. Enable redaction or blocking for this type.	ATLAS AML.T0055 Unsecured Credentials ATT&CK T1552 Unsecured Credentials
Possible secret in AI traffic content_safety_finding:generic_secret	A value that looks like a secret appeared in AI traffic. A credential sent to a model or tool can be stored, logged or reused by whoever receives it.	Rotate the credential if it is real, and find out how it reached the prompt or tool call. Enable redaction or blocking for this type.	ATLAS AML.T0055 Unsecured Credentials ATT&CK T1552 Unsecured Credentials
Social Security number in AI traffic content_safety_finding:ssn	A US Social Security number appeared in AI traffic. Personal data sent to a model or tool may leave your control and can create privacy and compliance exposure.	Confirm the data was meant to be shared. Enable redaction or blocking for this type if it was not.	ATLAS AML.T0057 LLM Data Leakage
Payment card number in AI traffic content_safety_finding:credit_card	A payment card number appeared in AI traffic. Personal data sent to a model or tool may leave your control and can create privacy and compliance exposure.	Confirm the data was meant to be shared. Enable redaction or blocking for this type if it was not.	ATLAS AML.T0057 LLM Data Leakage
Email address in AI traffic content_safety_finding:email	An email address appeared in AI traffic. Personal data sent to a model or tool may leave your control and can create privacy and compliance exposure.	Confirm the data was meant to be shared. Enable redaction or blocking for this type if it was not.	ATLAS AML.T0057 LLM Data Leakage
Internal IP address in AI traffic content_safety_finding:internal_ip	A private network address appeared in AI traffic. Personal data sent to a model or tool may leave your control and can create privacy and compliance exposure.	Confirm the data was meant to be shared. Enable redaction or blocking for this type if it was not.	ATLAS AML.T0057 LLM Data Leakage
Phone number in AI traffic content_safety_finding:phone	A phone number appeared in AI traffic. Personal data sent to a model or tool may leave your control and can create privacy and compliance exposure.	Confirm the data was meant to be shared. Enable redaction or blocking for this type if it was not.	ATLAS AML.T0057 LLM Data Leakage
Indian PAN in AI traffic content_safety_finding:pan	An Indian Permanent Account Number appeared in AI traffic. Personal data sent to a model or tool may leave your control and can create privacy and compliance exposure.	Confirm the data was meant to be shared. Enable redaction or blocking for this type if it was not.	ATLAS AML.T0057 LLM Data Leakage
Aadhaar number in AI traffic content_safety_finding:aadhaar	An Aadhaar number appeared in AI traffic. Personal data sent to a model or tool may leave your control and can create privacy and compliance exposure.	Confirm the data was meant to be shared. Enable redaction or blocking for this type if it was not.	ATLAS AML.T0057 LLM Data Leakage
Bank account number (IBAN) in AI traffic content_safety_finding:iban	An IBAN appeared in AI traffic. Personal data sent to a model or tool may leave your control and can create privacy and compliance exposure.	Confirm the data was meant to be shared. Enable redaction or blocking for this type if it was not.	ATLAS AML.T0057 LLM Data Leakage
Prompt injection attempt content_safety_finding:prompt_injection_pattern	Text matched a known prompt-injection phrase. Instructions injected into a model's input can override its guardrails or redirect an agent's tools.	Check where the text came from (user, document or tool output). Treat the source as untrusted and review what the agent did next.	ATLAS AML.T0051 LLM Prompt Injection
Attempt to override instructions content_safety_finding:instruction_manipulation	Text tried to change or discard the model's instructions. Instructions injected into a model's input can override its guardrails or redirect an agent's tools.	Check where the text came from (user, document or tool output). Treat the source as untrusted and review what the agent did next.	ATLAS AML.T0051 LLM Prompt Injection
Jailbreak attempt content_safety_finding:jailbreak_pattern	Text matched a known jailbreak pattern meant to bypass safety rules. Instructions injected into a model's input can override its guardrails or redirect an agent's tools.	Check where the text came from (user, document or tool output). Treat the source as untrusted and review what the agent did next.	ATLAS AML.T0054 LLM Jailbreak
Context-switching injection content_safety_finding:context_switching	Text tried to switch the model into a different role or context. Instructions injected into a model's input can override its guardrails or redirect an agent's tools.	Check where the text came from (user, document or tool output). Treat the source as untrusted and review what the agent did next.	ATLAS AML.T0051 LLM Prompt Injection
Indirect prompt injection content_safety_finding:indirect_injection	Content the agent read contains instructions aimed at the agent. Instructions injected into a model's input can override its guardrails or redirect an agent's tools.	Check where the text came from (user, document or tool output). Treat the source as untrusted and review what the agent did next.	ATLAS AML.T0051 LLM Prompt Injection
Markup-based injection content_safety_finding:markup_injection	Text hid instructions in markup or special tokens. Instructions injected into a model's input can override its guardrails or redirect an agent's tools.	Check where the text came from (user, document or tool output). Treat the source as untrusted and review what the agent did next.	ATLAS AML.T0051 LLM Prompt Injection
Encoded payload in text content_safety_finding:encoded_payload	Text carried an encoded or hidden payload. Instructions injected into a model's input can override its guardrails or redirect an agent's tools.	Check where the text came from (user, document or tool output). Treat the source as untrusted and review what the agent did next.	ATLAS AML.T0051 LLM Prompt Injection ATLAS AML.T0068 LLM Prompt Obfuscation
Hidden text direction controls content_safety_finding:unicode_bidi_control	Text used invisible direction-control characters to disguise content. Instructions injected into a model's input can override its guardrails or redirect an agent's tools.	Check where the text came from (user, document or tool output). Treat the source as untrusted and review what the agent did next.	ATLAS AML.T0068 LLM Prompt Obfuscation
Invisible character obfuscation content_safety_finding:unicode_obfuscation	Text used zero-width or invisible characters to hide content. Instructions injected into a model's input can override its guardrails or redirect an agent's tools.	Check where the text came from (user, document or tool output). Treat the source as untrusted and review what the agent did next.	ATLAS AML.T0068 LLM Prompt Obfuscation
Letter-spacing obfuscation content_safety_finding:char_obfuscation	Text spelled out words letter by letter to evade filters. Instructions injected into a model's input can override its guardrails or redirect an agent's tools.	Check where the text came from (user, document or tool output). Treat the source as untrusted and review what the agent did next.	ATLAS AML.T0068 LLM Prompt Obfuscation
Fake agent reasoning in content content_safety_finding:agent_reasoning_injection	Content imitated an agent's Thought or Action steps to steer it. Instructions injected into a model's input can override its guardrails or redirect an agent's tools.	Check where the text came from (user, document or tool output). Treat the source as untrusted and review what the agent did next.	ATLAS AML.T0051 LLM Prompt Injection
Injection detected by the classifier content_safety_finding:classifier_injection	The prompt-safety classifier scored the text as a prompt injection. Instructions injected into a model's input can override its guardrails or redirect an agent's tools.	Check where the text came from (user, document or tool output). Treat the source as untrusted and review what the agent did next.	ATLAS AML.T0051 LLM Prompt Injection
Jailbreak detected by the classifier content_safety_finding:classifier_jailbreak	The prompt-safety classifier scored the text as a jailbreak. Instructions injected into a model's input can override its guardrails or redirect an agent's tools.	Check where the text came from (user, document or tool output). Treat the source as untrusted and review what the agent did next.	ATLAS AML.T0054 LLM Jailbreak
Prompt scan covered only part of the text content_safety_finding:classifier_truncated	The classifier could scan only the start of a long input, so the rest was not checked.	Review the full input if it is high risk, or raise the scan limit in Settings.	None. This reports reduced scan coverage, not a detection.

Session anomalies

Per-session detectors for rate, size and output patterns.

Finding	Why it matters	Recommended action	MITRE mapping
Unusual session behavior session_anomaly	A session departed from normal call, token or output patterns.	Open the session to see what changed and whether it was expected.	None. This is an operational or behavioral signal. It does not establish an adversary technique by itself.
Unusually fast call rate session_anomaly:velocity	A session made calls much faster than a person or a healthy agent normally does. A runaway loop or a flood can exhaust limits and cost.	Check whether an agent is looping. Pause the session or lower its rate limit.	None. This is an operational or behavioral signal. It does not establish an adversary technique by itself.
Single request used far more tokens than usual session_anomaly:spike	One request was far larger than normal. Large inputs can mean bulk data is being sent to a model.	Open the request to see what was sent and whether it was intended.	None. This is an operational or behavioral signal. It does not establish an adversary technique by itself.
Spend is climbing faster than usual session_anomaly:burn_rate	This session is consuming tokens faster than the last one. Unchecked, it can drive up cost or exhaust a budget.	Check the session for loops or oversized prompts. Set or lower a session budget.	None. This is an operational or behavioral signal. It does not establish an adversary technique by itself.
Same prompt repeated many times session_anomaly:repetition	A session sent the same prompt repeatedly, which usually means a stuck agent or a retry loop.	Check the agent for a retry loop and stop the session if it is not making progress.	None. This is an operational or behavioral signal. It does not establish an adversary technique by itself.
Model slowing as context grows session_anomaly:context_pressure	Response time is growing as the conversation lengthens, which suggests the context window is filling and quality will degrade.	Start a fresh session or summarize the context.	None. This is an operational or behavioral signal. It does not establish an adversary technique by itself.
Agent output is repeating session_anomaly:loop	The model keeps producing the same structure, a sign it is stuck and spending tokens without progress.	Stop the session and review the task or prompt.	None. This is an operational or behavioral signal. It does not establish an adversary technique by itself.
Output far longer than normal for this model session_anomaly:output_verbosity_high	Output tokens reached about twice the usual level for this model, which raises cost and can signal a runaway response.	Review the prompt and set a maximum output length.	None. This is an operational or behavioral signal. It does not establish an adversary technique by itself.

Behavior baselines

Deviations from an agent's learned normal behavior.

Finding	Why it matters	Recommended action	MITRE mapping
Behavior differs from this agent's baseline baseline_alert	An agent's recent activity deviates from what it normally does. A deviation is a prompt to look, not proof of misuse.	Open the alert to compare the observed value with the baseline, then confirm the change was intended.	None. This is an operational or behavioral signal. It does not establish an adversary technique by itself.
Tool call rate differs from baseline baseline_alert:tool_call_rate	The agent is calling tools at a rate outside its normal range.	Check whether a task or a loop explains it.	None. This is an operational or behavioral signal. It does not establish an adversary technique by itself.
Tokens per call differ from baseline baseline_alert:token_consumption_per_call	Calls are using more or fewer tokens than this agent normally does.	Check for larger prompts, pasted data or a changed model.	None. This is an operational or behavioral signal. It does not establish an adversary technique by itself.
Denial rate differs from baseline baseline_alert:deny_rate	More of this agent's calls are being denied than usual, which can mean new behavior hitting a policy.	Review the denied calls and the policies involved.	None. This is an operational or behavioral signal. It does not establish an adversary technique by itself.
Tool variety differs from baseline baseline_alert:unique_tools_per_session	The agent is using a different number of distinct tools than usual.	Check whether new tools or servers were added to its scope.	None. This is an operational or behavioral signal. It does not establish an adversary technique by itself.
Activity outside normal hours baseline_alert:off_hours_activity	The agent or its owner is active at a time that is unusual for them. Credentials used off-hours are a common sign of misuse.	Confirm with the owner. Rotate credentials if the activity was not theirs.	ATLAS AML.T0012 Valid Accounts ATT&CK T1078 Valid Accounts
Agent used a tool for the first time baseline_alert:new_tool_introduced	The agent called a tool it has not used before. New tools widen what it can reach.	Confirm the tool is intended for this agent, and add it to its declared scope if so.	None. This is an operational or behavioral signal. It does not establish an adversary technique by itself.

Attack patterns

Ordered sequences of actions that together resemble an attack. A custom template shows the general entry.

Finding	Why it matters	Recommended action	MITRE mapping
Suspicious sequence of actions attack_pattern	An agent or workload performed a chain of actions that together resemble an attack, even if each step was allowed.	Open the evidence to read the steps, then decide whether the sequence was intended.	None. A custom or renamed template has no fixed technique; the mapping depends on its steps.
Sensitive data read, then sent out attack_pattern:sensitive-read-egress	An agent read sensitive data and then made an outbound call. Together these resemble data theft.	Review what was read and where it went. Revoke the agent's access or block the destination if the transfer was not intended.	ATLAS AML.T0086 Exfiltration via AI Agent Tool Invocation
Sensitive data staged, then sent out attack_pattern:exfil-chain	An agent read sensitive data, wrote it somewhere, then sent data out. Staging before exfiltration is a common pattern.	Review the written location and the destination. Contain the agent and rotate anything exposed.	ATLAS AML.T0086 Exfiltration via AI Agent Tool Invocation
Data deleted, then an outbound call attack_pattern:destructive-then-call	An agent deleted data and then reached out externally. This can be destruction followed by reporting or covering tracks.	Confirm what was deleted and restore it if needed. Review the outbound destination.	ATLAS AML.T0101 Data Destruction via AI Agent Tool Invocation ATT&CK T1485 Data Destruction
File written, then executed attack_pattern:write-then-execute	An agent wrote content and then ran code. A model-written file that is then executed is a route to running attacker-chosen commands.	Review the written content and the command that ran. Restrict execution to approved tools.	ATLAS AML.T0050 Command and Scripting Interpreter ATT&CK T1059 Command and Scripting Interpreter
Privilege change, then a sensitive action attack_pattern:privilege-escalation	An agent raised its own privilege and then read sensitive data, wrote, or sent data out.	Review how the privilege was gained and whether it was approved. Reduce the agent's tier if not.	ATT&CK T1548 Abuse Elevation Control Mechanism
Credential file opened, then ungoverned outbound traffic attack_pattern:kernel-credential-open-egress	A workload opened a credential file and then made a connection that the gateway did not govern, as seen by the kernel sensor.	Identify the process and destination. Rotate the credential and isolate the workload if the connection was not expected.	ATT&CK T1552.001 Credentials In Files
Governed action, then an undeclared outbound call attack_pattern:declared-then-undeclared-egress	After a governed call, the workload contacted a destination it never declared. Bypassing governance to reach out is a strong exfiltration signal.	Contain the workload and review the destination. Add it to the declared scope only if it is legitimate.	ATLAS AML.T0086 Exfiltration via AI Agent Tool Invocation
Large volume of reads, then sent out attack_pattern:bulk-read-egress	No single read looked sensitive, but many reads added up to a dataset that then left. Collecting data in bulk before sending it is a common exfiltration pattern.	Check what was read and the destination. Limit the agent's read scope or rate and block the destination if needed.	ATLAS AML.T0036 Data from Information Repositories ATT&CK T1119 Automated Collection

Inventory

Servers and workloads that are in use but not registered.

Finding	Why it matters	Recommended action	MITRE mapping
MCP server in use but not registered ungoverned_mcp_server	Traffic reached an MCP server that is not in the registry, so no access policy or review applies to it.	Register the server and review its tools, or block it.	None. This is a gap in inventory. It does not show that an adversary technique was used.
Unregistered workload blocked unregistered_workload_blocked	A workload that is not registered called the gateway and was denied.	Register the workload if it is legitimate; otherwise find out what started it.	None. This is a gap in inventory. It does not show that an adversary technique was used.
Unregistered workload allowed (audit mode) unregistered_workload_shadowed	A workload that is not registered called the gateway and was allowed because enforcement is in Audit mode.	Register the workload, then move enforcement to Enforce.	None. This is a gap in inventory. It does not show that an adversary technique was used.

Runtime

Behavior seen by the kernel sensor on a workload.

Finding	Why it matters	Recommended action	MITRE mapping
Workload looked up a name runtime_dns	The kernel sensor saw a workload resolve a DNS name. A lookup is weak evidence: it shows intent to connect, not a connection.	Review the name if it is unfamiliar. No action is needed for routine lookups.	None. A lookup alone does not establish a technique.
Workload made a network connection runtime_network	The kernel sensor saw a workload open a connection. It may have reached outside governance.	Check the destination against what the workload is expected to call.	None. An observed connection does not show intent, so no single technique applies.
Workload opened a file runtime_open	The kernel sensor saw a workload open a file it was watching for.	Check whether the file access is expected for this workload.	None. A file open does not show intent. Credential-file opens followed by egress are matched by attack patterns.
Workload started a process runtime_exec	The kernel sensor saw a workload start a process. Unexpected processes in an agent workload can mean code execution.	Check the command against what the workload normally runs.	None. A process start is routine. It shows a command ran, not that it was an adversary technique.
Runtime activity observed runtime_observation	The kernel sensor reported behavior that does not fit a more specific type.	Open the evidence to see what was observed.	None. The behavior is not specific enough to map to a technique.
Runtime activity blocked by the kernel runtime_blocked	A runtime policy in enforce mode denied an action before it happened.	Check which policy blocked it and whether the workload should be allowed to do this.	None. A block shows a control worked. It does not say which technique was attempted.
Network connection blocked by the kernel runtime_network_blocked	A runtime policy in enforce mode denied a connection a workload tried to make.	Check the destination. Allow it in the runtime policy only if it is legitimate.	None. A blocked connection shows a control worked. It does not show the destination was an exfiltration channel or which technique was attempted.
File open blocked by the kernel runtime_open_blocked	A runtime policy in enforce mode denied a workload opening a protected file.	Check which file and which process. Look for other attempts from the same workload.	None. A block shows a control worked. It does not say which technique was attempted.
Process start blocked by the kernel runtime_exec_blocked	A runtime policy in enforce mode denied a workload starting a process.	Check the command and who or what requested it. Look for other attempts from the same workload.	None. A blocked process start shows a control worked. It does not say which technique was attempted.
Runtime sensor outage runtime_sensor_outage	The runtime sensor was down, unhealthy on a node, or its events did not reach AIControls. Until it recovers, traffic that bypasses the proxy cannot be seen and workload readiness rule R6 fails closed.	Restore the sensor on every node and check that runtime events reach AIControls. R6 passes again once the gap leaves the readiness window.	None. This is a gap in runtime sensor coverage. It does not show that an adversary technique was used, but traffic that bypasses the proxy could have gone unseen.