Events are discrete interactions between two participants in an AI system (usually an agentic system) that involve an input, processing, and an output.
Overview
Event monitoring captures and analyzes interactions in your AI ecosystem, from simple chat completions to sophisticated multi-agent workflows. Each Event represents a communication between different participants in your AI system and provides detailed insights into the flow, security, and compliance of your AI operations.
Event Structure
Every Event contains four core components.
1. Event Participants
Events are categorized by the participants involved in the interaction:
| Participant | Description |
|---|---|
| User | The end user initiating requests and interactions |
| LLM | Large language models processing requests |
| Agent | Autonomous agents in agentic frameworks |
| Tool | External tools, APIs, or plugins agents can access |
| Memory | Memory storage systems for agent state |
| Initialization | Agent initialization (future feature) |
2. Event Types
Events are classified based on participant relationships:
Basic Events
- user_llm: Standard user-to-LLM interactions (chat completions, Q&A)
- user_agent: User requesting an agentic system to perform tasks
Agent Events
- agent_llm: Agent communicating with LLMs for various purposes
- agent_tool: Agent invoking external tools or APIs
- agent_agent: Agent-to-agent communication
- agent_mem: Agent accessing memory storage
- agent_init: Agent initialization and configuration
Agent-LLM Event Subtypes
- agent_llm.planning: Agent requesting workflow planning from LLM
- agent_llm.action: Agent asking LLM how to execute specific actions
- agent_llm.content: Agent requesting content creation from LLM
Tool Integration Events
- agent_tool.mcp: Agent using Model Context Protocol (MCP)
- agent_tool.api: Direct API tool invocations
- agent_tool.data_source: Agent accessing non-MCP data sources
Agent Communication Events
- agent_agent.a2a: Agent-to-Agent protocol communication
- agent_agent.custom_channel: Custom communication channels
3. Event Properties
Each event includes comprehensive metadata and analysis results:
Core Identifiers
- event_id: Unique ULID identifier (lexicographically sortable)
- event_type: Classification based on participants
- session_id: Groups related events in a session
- profile_id: Associated Aiceberg monitoring profile
Content
- input: The original request or message
- output: The response from the receiving participant
- user_id: Identifier for the initiating user or application
Analysis Results
- input_signal_result: Security and compliance analysis of inputs
- output_signal_result: Analysis of outputs
- event_result: Overall event assessment
- input_system_actions: Automated actions taken on inputs
- output_system_actions: Automated actions taken on outputs
4. Event Status
Events progress through various states:
| Status | Description |
|---|---|
created |
Event logged and queued for analysis |
running |
Analysis in progress |
running.input_analysis |
Analyzing input content |
running.fetching_llm_response |
Waiting for LLM response |
running.output_analysis |
Analyzing output content |
finished.input_blocked |
Input blocked by policies |
finished.output_blocked |
Output blocked by policies |
success |
Event completed successfully |
success.input_modified |
Input was modified before processing |
success.output_modified |
Output was modified before delivery |
failed |
Event processing failed |
Event Monitoring
Viewing Single Events
Events appear in the Monitoring interface and Prompt Details.
To view Events in Monitoring, navigate to the appropriate tab and tap the filter icon.
Tap the gear icon and enable the Event To and Event From columns.
Event icons are now visible. Filtering and sorting on Event type, status, or participant will be included in a future release. Hovering over an Event icon will show the participant type.
In Prompt Details, Event participant icons are located near the Prompt and Response text.
Viewing Events as Part of an Agentic Workflow
Single events can be seen in context by enabling the Sessions view in Monitoring. Learn more about Sessions here. For complex agentic systems, event monitoring provides:
Planning Visibility
Track how agents break down complex requests:
user_agent: "Create a quarterly report"
└── agent_llm.planning: Agent requests execution plan
└── agent_tool.data_source: Agent retrieves Q3 data
└── agent_llm.content: Agent generates report sectionsTool Usage Tracking
Monitor agent tool interactions:
- API calls and responses
- Data source queries
- MCP protocol communications
- Custom tool integrations
Agent Communication
Observe multi-agent coordination:
- Task delegation between agents
- Information sharing
- Collaborative problem-solving
Best Practices
Event Organization
- Implement session management for related interactions
- Leverage event subtypes for granular analysis
Security Monitoring
- Regularly review failed events for security indicators
- Monitor agent tool usage for unauthorized access attempts
- Track input/output modifications for compliance auditing
Performance Optimization
- Filter events by time range for large-scale analysis
- Use event_type filtering to focus on specific workflows
- Monitor processing times for performance insights