AI Session Analysis Results 🆕¶

While a monitored session runs, each analysis agent attached to its safe stores what it found. The results are exposed at two levels: one row per agent summarising its work on the session, and one verdict per finding. An operator can adjudicate a verdict - confirm it or mark it a false positive - and that judgment is recorded as a separate feedback object.

Configuring the agents themselves is described in AI Session Analysis Agents 🆕.

Data Structures¶

`SessionAnalysisAgentModel`¶
Attribute	Type	Required	Description
`id`	string		Read-only.
`session_id`	string	yes	ID of the session this analysis belongs to.
`user_id`	string		Read-only; hidden; expensive to use. Virtual attribute that filters out sessions not granted to the subject. Requires `session-view` right on object type `user`.
`agent_id`	string		Read-only. Analysis agent this row describes.
`agent_name`	string		Read-only; expensive to use. Name of the agent. Resolves even after the agent is removed, so old analyses stay attributed.
`status`	string {live, finished, failed}		Read-only; expensive to use. Whether the agent is still analyzing the session. `finished` and `failed` are both terminal.
`current_severity`	string {unknown, low, medium, high}		Read-only; expensive to use. Severity of the agent’s latest verdict. `unknown` marks a coverage gap: the latest batch could not be analyzed.
`peak_severity`	string {unknown, low, medium, high}		Read-only; expensive to use. Highest severity the agent reported for the session.
`latest_summary`	string		Read-only. Summary of the agent’s latest verdict.
`verdict_count`	number		Read-only. Number of verdicts the agent stored for the session.
`provider_name`	string		Read-only. Name the LLM provider had when the analysis started.
`provider_kind`	string		Read-only. Provider kind the analysis ran on.
`provider_url`	string		Read-only. Endpoint the analysis was sent to.
`provider_model`	string		Read-only. Model that produced the verdicts.
`tokens_in`	number		Read-only. Prompt tokens the agent consumed for the session.
`tokens_out`	number		Read-only. Completion tokens the agent consumed for the session.
`created_at`	datetime		Read-only. Timestamp of creation.
`modified_at`	datetime		Read-only. Timestamp of modification.
`removed`	boolean		Read-only.

`SessionAnalysisVerdictModel`¶
Attribute	Type	Required	Description
`id`	string		Read-only.
`session_id`	string	yes	ID of the session this verdict belongs to.
`user_id`	string		Read-only; hidden; expensive to use. Virtual attribute that filters out sessions not granted to the subject. Requires `session-view` right on object type `user`.
`severity`	string {unknown, low, medium, high}		Read-only; expensive to use. Severity reported by this verdict. `unknown` marks a batch that could not be analyzed.
`summary`	string		Read-only; expensive to use. Human readable summary of the verdict.
`indicators`	string-array		Read-only; expensive to use. Indicators backing the verdict.
`first_event`	number		Read-only. First session event covered by the verdict.
`last_event`	number		Read-only. Last session event covered by the verdict.
`time_offset_ms`	number		Read-only. Offset within the session, in milliseconds, where the analyzed batch ended - the moment to play, since the activity the verdict describes has happened by then.
`agent_id`	string		Read-only; expensive to use. Agent that produced the verdict.
`agent_name`	string		Read-only; expensive to use. Name of that agent. Resolves even after the agent is removed.
`judgment`	string {confirmed, false_positive}		Read-only; expensive to use. Operator judgment recorded for this verdict, if any.
`override_severity`	string {low, medium, high}		Read-only; expensive to use. Severity the operator considers correct, overriding `severity`.
`judged_by`	string		Read-only; expensive to use. Operator who recorded the judgment.
`feedback_id`	string		Read-only; expensive to use. Identifier of the adjudication row, used to update or retract it.
`created_at`	datetime		Read-only. Timestamp of creation.
`modified_at`	datetime		Read-only. Timestamp of modification.
`removed`	boolean		Read-only.

`SessionAnalysisVerdictFeedbackModel`¶
Attribute	Type	Required	Description
`id`	string		Read-only. Uniqueness is required.
`verdict_id`	string	yes	Immutable. Verdict this adjudication belongs to.
`user_id`	string		Read-only; hidden; expensive to use. Virtual attribute gating access to the session the verdict belongs to. Requires `session-view` right on object type `user`.
`judgment`	string {confirmed, false_positive}	yes	Operator judgment on the verdict.
`override_severity`	string {low, medium, high}		Severity the operator considers correct, overriding the verdict severity.
`note`	string		Free-form operator note explaining the judgment. May be empty.
`judged_by`	string		Immutable. Operator who recorded this judgment.
`created_at`	datetime		Read-only. Timestamp of creation.
`modified_at`	datetime		Read-only. Timestamp of modification.
`removed`	boolean		Read-only.

Note

The session object carries the same results in aggregated form - analysis_status, analysis_severity, analysis_peak_severity, analysis_summary and analysis_verdict_count on the SessionModel. Use those when listing sessions, and the endpoints below when you need the per-agent or per-verdict detail.

Retrieve Available Attributes¶

Request

Method	`GET`
Path	`/api/v2/objspec/session_analysis_agent`, `/api/v2/objspec/session_analysis_verdict`, `/api/v2/objspec/session_analysis_verdict_feedback`

GET /api/v2/objspec/session_analysis_verdict

Example Request

curl -s -k -X GET \
  -H 'Authorization: <token>' \
  'https://10.33.3.167/api/v2/objspec/session_analysis_verdict'

List Per-Agent Analyses¶

Request

Method	`GET`
Path	`/api/v2/session/analysis_agent`

GET /api/v2/session/analysis_agent

Restrict the result to one session with the filter parameter, for example ?filter=session_id.eq(<session_id>).

Example Request

curl -s -k -X GET \
  -H 'Authorization: <token>' \
  'https://10.33.3.167/api/v2/session/analysis_agent?filter=session_id.eq(549439154539200513)'

Response

{
    "result": "success",
    "session_analysis_agent": [
        {
            "id": "549439154539200513",
            "session_id": "549439154539200513",
            "agent_id": "549439154539200513",
            "agent_name": "Agent_1",
            "status": "live",
            "current_severity": "medium",
            "peak_severity": "medium",
            "latest_summary": "The user attempts to list theirsudo permissions by running `sudo -l`, which requires a password. This action is part of administrative tasks and warrants human review.",
            "verdict_count": 1,
            "provider_name": "Fudo_AI",
            "provider_kind": "ollama",
            "provider_url": "http://10.0.240.10:11435/api/chat",
            "provider_model": "qwen2.5",
            "tokens_in": 2878,
            "tokens_out": 105,
            "created_at": "2026-08-18 11:15:17.903392-07",
            "modified_at": "2026-08-18 11:17:09.995082-07"
        }
    ]
}

Note

provider_name, provider_kind, provider_url and provider_model record what the analysis actually ran on, so the values stay meaningful after the provider is reconfigured or removed. tokens_in and tokens_out let you attribute model cost to a session.

List Verdicts¶

Request

Method	`GET`
Path	`/api/v2/session/analysis_verdict`

GET /api/v2/session/analysis_verdict

Example Request

curl -s -k -X GET \
  -H 'Authorization: <token>' \
  'https://10.33.3.167/api/v2/session/analysis_verdict?filter=session_id.eq(549439154539200513)'

Response

{
    "result": "success",
    "session_analysis_verdict": [
        {
            "id": "549439154539200513",
            "session_id": "549439154539200513",
            "severity": "medium",
            "summary": "The user attempts to list theirsudo permissions by running `sudo -l`, which requires a password. This action is part of administrative tasks and warrants human review.",
            "first_event": 78,
            "last_event": 95,
            "time_offset_ms": 102850,
            "agent_id": "549439154539200513",
            "agent_name": "Agent_1",
            "created_at": "2026-08-18 11:17:09.991808-07",
            "modified_at": "2026-08-18 11:17:09.991808-07"
        }
    ]
}

Note

Use time_offset_ms to position the session player - the activity the verdict describes has already happened by that offset. first_event and last_event identify the same fragment in terms of session events.

The adjudication attributes - judgment, override_severity, judged_by and feedback_id - are absent until a verdict is adjudicated.

Adjudicate a Verdict¶

Request

Method	`POST`
Path	`/api/v2/session/analysis_verdict/feedback`
Body	`SessionAnalysisVerdictFeedbackModel`

POST /api/v2/session/analysis_verdict/feedback

Example Request

curl -s -k -X POST \
  -H 'Authorization: <token>' \
  -H 'Content-Type: application/json' \
  -d '{"verdict_id":"549439154539200513","judgment":"confirmed","override_severity":"low","note":"Routine sudo -l by an administrator; recorded for completeness."}' \
  'https://10.33.3.167/api/v2/session/analysis_verdict/feedback'

Response

{
    "result": "success",
    "session_analysis_verdict_feedback": {
        "id": "549439154539200513"
    }
}

Once the adjudication exists, the verdict reports it:

{
    "id": "549439154539200513",
    "severity": "medium",
    "judgment": "confirmed",
    "override_severity": "low",
    "judged_by": "549439154539200513",
    "feedback_id": "549439154539200513"
}

Note

severity keeps the value the agent reported. override_severity records what the operator considers correct, so both the model’s answer and the human correction remain visible.

List Adjudications¶

Request

Method	`GET`
Path	`/api/v2/session/analysis_verdict/feedback`

GET /api/v2/session/analysis_verdict/feedback

Example Request

curl -s -k -X GET \
  -H 'Authorization: <token>' \
  'https://10.33.3.167/api/v2/session/analysis_verdict/feedback'

Response

{
    "result": "success",
    "session_analysis_verdict_feedback": [
        {
            "id": "549439154539200513",
            "verdict_id": "549439154539200513",
            "judgment": "confirmed",
            "override_severity": "low",
            "note": "Routine sudo -l by an administrator; recorded for completeness.",
            "judged_by": "549439154539200513",
            "created_at": "2026-08-18 11:18:16.703842-07",
            "modified_at": "2026-08-18 11:18:16.703842-07"
        }
    ]
}

Modify an Adjudication¶

Request

Method	`PATCH`
Path	`/api/v2/session/analysis_verdict/feedback/<id>`
Body	`SessionAnalysisVerdictFeedbackModel`

PATCH /api/v2/session/analysis_verdict/feedback/<id>

Attributes left out of the body keep their current values.

Example Request

curl -s -k -X PATCH \
  -H 'Authorization: <token>' \
  -H 'Content-Type: application/json' \
  -d '{"judgment":"false_positive","note":"Reclassified after review: the operator was authorised for this check."}' \
  'https://10.33.3.167/api/v2/session/analysis_verdict/feedback/549439154539200513'

Response

{
    "result": "success"
}

Retract an Adjudication¶

Request

Method	`DELETE`
Path	`/api/v2/session/analysis_verdict/feedback/<id>`

DELETE /api/v2/session/analysis_verdict/feedback/<id>

Example Request

curl -s -k -X DELETE \
  -H 'Authorization: <token>' \
  'https://10.33.3.167/api/v2/session/analysis_verdict/feedback/549439154539200513'

Response

{
    "result": "success"
}

Retracting the adjudication clears it from the verdict, which returns to reporting only what the agent found:

{
    "id": "549439154539200513",
    "severity": "medium",
    "judgment": null,
    "override_severity": null,
    "feedback_id": null
}