Use the Executions page to view a list of recent Red Canary Agent activity in your environment. By default, the list is filtered to show a trailing seven-day period.
The page uses five sortable columns of data to summarize the Agent activity:
Executed At - The date and time (UTC) when the Agent ran
Agent - The Agent name
Input - The type of Red Canary activity the Agent is responding to (External Alert, Reported Phish, Customization, Detection, or Event)
Summary - A top-level description of the Agent’s action. Where available, this includes a link to the input item the Agent was responding to (for example, an event or threat)
Status - The status of the execution (Successful or Failed)
Viewing Execution Details
You can examine the details for an individual execution by clicking on the Agent name.
The slide-out panel displays the following details about the Agent execution:
Job Description
An explanation of the Agent’s primary purpose.
Standard Operating Procedure
The full list of individual tasks the Agent performs when it runs.
Attributes
The Agent category (Investigation, Response, Email Security, User Behavioral Analysis), version number, and last modified date.
Total Executions
The number of times the Agent has run in this environment and globally across the entire Red Canary system, starting in March 2026.
Recent Executions
The date and time in UTC for the last five times the Agent ran in the current environment. Where available, the Summary includes a link to the issue the Agent was responding to (for example, an event or threat).
Viewing Agent Executions in the Investigation or Threat
Where relevant, you can click the link in the execution summary and jump to the issue the Agent was responding to. For example, an Event link will open the Investigation and show you the Agent-generated note.
Filtering Agent Executions
In addition to sorting the summary data on the Executions page, you can also use the search function to filter the list.
Using the Search Box
To manually build a filter:
Enter your filter attributes in the Search by agent, input type, status, or summary box. Note that you can click on the example searches in the UI to copy the text as a template.
Press Enter to apply the filter.
Note: Multiple attributes are applied with the AND logical operator, so each attribute further narrows the filter.
The following filter attributes are available:
Attribute Name | Description | Example |
Keywords | Plain keyword filtering (with no attribute specified). Unlike the defined attributes filters, keywords match on partial values. |
|
Agent | Filter by agent identifier. Use | as an "OR" to filter for multiple agents. |
|
Input Type | Filter by the input object type the agent operated on. Use | for multiple types. |
|
Status | Filter by execution status. Use I for multiple statuses. |
|
Summary | Search within the summary text. Use quotes for phrases with spaces. |
|
Executed At | Filter by execution date and time. |
|
Case Matching
All filter attribute matches are case-insensitive.
Dates/Times
Date-based attributes are specified using from..to syntax, where from and to are date-times or ISO 8601 dates. You can omit either from or to to filter for unbounded times. For example:
2026-04-05..matches on or after (>=) the from date..2026-03-31matches on or before (<= the to date2026-03-31..2026-05-05matches on or after (>=) the from date and on or before (<=) the to date
Using the Filter Icon
As an alternative to entering attributes manually in the Search by agent, input type, status, or summary box, you can use the UI to create your filter attributes.
Click the filter icon
to show available options.
Use the dropdowns and text boxes to define the filters.
Click Apply Filters to build the filter string and apply it.