Activity stream events
Use this page to parse the activity stream in your SIEM. Each agent event the console lists becomes one OCSF 1.1.0 API Activity event. To turn the stream on, see Send events to your SIEM. The events streamed are those each agent reports, which depends on the agent: see Control levels.
Fields
Section titled “Fields”| Field | Value |
|---|---|
| Class | class_uid 6003, class name API Activity |
| Activity | activity_id 99, with the kind label below as the activity name |
| Type | type_uid 600399 |
| Event id | metadata.uid, one id per event, the same on every re-send. Deduplicate on it |
| Profiles | metadata.profiles holds the cloud profile; the cloud object names OpenLatch as the provider |
| Time | When the agent reported the event, in epoch milliseconds |
| Severity | severity_id, from the table below |
| Operation | api.operation: the tool name, or the kind label when the event has no tool |
| Identity | The user and the host at the time of the action. With Hash personal data on, they leave as keyed hashes |
| Decision | olverdict, olverdictshadow, olmode, olpolicyid and olpolicyruleid under unmapped.openlatch, only on events that carry an OpenLatch decision |
| Agent | agent_id and platform under unmapped.openlatch, from the agent record. platform is the agent platform, for example claude-code. agent_type carries the same value and is deprecated: parse platform |
| Session | session_id under unmapped.openlatch |
| Console link | console_url under unmapped.openlatch: the event in the console |
Verdicts leave in upper case: ALLOW, ASK, BLOCK, OPTIMIZE.
Kind labels
Section titled “Kind labels”| Event types | Kind label |
|---|---|
pre_tool_use | Tool Call |
post_tool_use, post_tool_use_failure, post_tool_batch | Tool Result |
user_prompt_submit | Prompt Submit |
session_start | Session Start |
session_end, session_shutdown, stop, interrupt | Session End |
subagent_start | Sub-Agent Start |
subagent_stop | Sub-Agent Stop |
permission_request | Permission Request: the agent’s own permission prompt, never an OpenLatch Ask |
notification, message_display | Notification |
ai.openlatch.economics.usage | Model Usage |
| Configuration events | Config Change |
| Client lifecycle events | Client Lifecycle |
ai.openlatch.security.tamper_detected | Tamper Detected |
ai.openlatch.security.tamper_healed | Tamper Healed |
ai.openlatch.decision.resolved | Decision Resolved |
Any other type the console lists takes the last part of its name, each word capitalized.
Severity
Section titled “Severity”| Event | severity_id |
|---|---|
| Block under Enforce | 4 |
| Ask under Enforce | 3 |
| Monitor, would-have Block | 3 |
| Optimize under Enforce; Monitor, would-have Ask or Optimize | 2 |
| Allow, and every event that carries no decision | 1 |
Content
Section titled “Content”With Send prompt text and tool input on, each event carries content under unmapped.openlatch:
| Field | Value |
|---|---|
| Prompt text | Scrubbed of secrets and e-mail addresses, capped at 2 KB, with a flag when it was cut and a flag when it was withheld because a secret remained |
| Tool input | The tool’s arguments, with sensitive keys replaced by [REDACTED] and file contents and replacement text dropped, then scrubbed and capped the same way |
With content off, a prompt event carries only prompt_length, never its text. Tool responses, file contents and command output never leave OpenLatch. Each event stays under 8 KB; content is trimmed first.