--- title: "Monitor Agent Executions" slug: "agent-executions" updated: 2026-09-09T16:09:40Z published: 2026-09-09T16:09:40Z canonical: "docs.redcanary.com/agent-executions" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.redcanary.com/llms.txt > Use this file to discover all available pages before exploring further. # Monitor Agent Executions Use the **Executions** page to view a list of recent Zscaler MDR Agent activity in your environment. By default, the list is filtered to show a trailing seven-day period.![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/agents-003.png?sv=2026-02-06&spr=https&st=2026-10-27T03%3A16%3A24Z&se=2026-10-27T04%3A16%3A24Z&sr=c&sp=r&sig=Uf%2FMOYOtwyT9cKW63Lx4yNHelIknNAxSsYyxnrwLIGs%3D) The page uses five sortable columns of data to summarize the Agent activity: - **Executed At** - The date and time (UTC) when the Agent ran - **Agent** - The Agent name - **Input** - The type of Zscaler MDR activity the Agent is responding to (External Alert, Reported Phish, Customization, Detection, or Event) - **Summary** - A top-level description of the Agent’s action. Where available, this includes a link to the input item the Agent was responding to (for example, an event or threat) - **Status** - The status of the execution (Successful or Failed) ## Viewing Execution Details You can examine the details for an individual execution by clicking on the Agent name. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/agents-004.png?sv=2026-02-06&spr=https&st=2026-10-27T03%3A16%3A24Z&se=2026-10-27T04%3A16%3A24Z&sr=c&sp=r&sig=Uf%2FMOYOtwyT9cKW63Lx4yNHelIknNAxSsYyxnrwLIGs%3D) The slide-out panel displays the following details about the Agent execution: **Job Description** An explanation of the Agent’s primary purpose. **Standard Operating Procedure** The full list of individual tasks the Agent performs when it runs. **Attributes** The Agent category (Investigation, Response, Email Security, User Behavioral Analysis), version number, and last modified date. **Total Executions** The number of times the Agent has run in this environment and globally across the entire Zscaler MDR system, starting in March 2026. **Recent Executions** The date and time in UTC for the last five times the Agent ran in the current environment. Where available, the Summary includes a link to the issue the Agent was responding to (for example, an event or threat). ### Viewing Agent Executions in the Investigation or Threat Where relevant, you can click the link in the execution summary and jump to the issue the Agent was responding to. For example, an Event link will open the Investigation and show you the Agent-generated note. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/agents-005.png?sv=2026-02-06&spr=https&st=2026-10-27T03%3A16%3A24Z&se=2026-10-27T04%3A16%3A24Z&sr=c&sp=r&sig=Uf%2FMOYOtwyT9cKW63Lx4yNHelIknNAxSsYyxnrwLIGs%3D) ## Filtering Agent Executions In addition to sorting the summary data on the **Executions** page, you can also use the search function to filter the list. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/agents-006.png?sv=2026-02-06&spr=https&st=2026-10-27T03%3A16%3A24Z&se=2026-10-27T04%3A16%3A24Z&sr=c&sp=r&sig=Uf%2FMOYOtwyT9cKW63Lx4yNHelIknNAxSsYyxnrwLIGs%3D) ### Using the Search Box To manually build a filter: 1. Enter your filter attributes in the **Search by agent, input type, status, or summary** box. Note that you can click on the example searches in the UI to copy the text as a template. 2. Press **Enter** to apply the filter. > [!NOTE] > **Note:** Multiple attributes are applied with the AND logical operator, so each attribute further narrows the filter. The following filter attributes are available: | **Attribute Name** | **Description** | **Example** | | --- | --- | --- | | *Keywords* | Plain keyword filtering (with no attribute specified). Unlike the defined attributes filters, keywords match on partial values. | `comment` `12345` | | Agent | Filter by agent identifier. Use \| as an "OR" to filter for multiple agents. | `agent:threat_report_agent` `agent:threat_report_agent\|threat_review_agent` | | Input Type | Filter by the input object type the agent operated on. Use \| for multiple types. | `input:event` `input:detection\|event` | | Status | Filter by execution status. Use I for multiple statuses. | `status:failed` `status:successful\|failed` | | Summary | Search within the summary text. Use quotes for phrases with spaces. | `summary:error` `summary:"recommendation generated"` | | Executed At | Filter by execution date and time. | `executed_at:2026-04-05..` `executed_at:2026-03-30..2026-04-06` | **Case Matching** All filter attribute matches are case-insensitive. **Dates/Times** Date-based attributes are specified using `from..to` syntax, where `from` and `to` are date-times or ISO 8601 dates. You can omit either `from` or `to` to filter for unbounded times. For example: - `2026-04-05..` matches on or after (>=) the from date - `..2026-03-31` matches on or before (<= the to date - `2026-03-31..2026-05-05` matches on or after (>=) the from date and on or before (<=) the to date ### Using the Filter Icon As an alternative to entering attributes manually in the **Search by agent, input type, status, or summary** box, you can use the UI to create your filter attributes. 1. Click the filter icon ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/filter_icon.png?sv=2026-02-06&spr=https&st=2026-10-27T03%3A16%3A24Z&se=2026-10-27T04%3A16%3A24Z&sr=c&sp=r&sig=Uf%2FMOYOtwyT9cKW63Lx4yNHelIknNAxSsYyxnrwLIGs%3D) to show available options. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/agents-007.png?sv=2026-02-06&spr=https&st=2026-10-27T03%3A16%3A24Z&se=2026-10-27T04%3A16%3A24Z&sr=c&sp=r&sig=Uf%2FMOYOtwyT9cKW63Lx4yNHelIknNAxSsYyxnrwLIGs%3D) 2. Use the dropdowns and text boxes to define the filters. 3. Click **Apply Filters** to build the filter string and apply it.