> For the complete documentation index, see [llms.txt](https://docs.ox.security/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.ox.security/ox-cloud/ox-runtime-sensor/runtime-events.md).
# Runtime Events
Runtime Events helps you monitor and investigate runtime activity across your cloud environments in real time. Instead of relying only on scheduled security scans, Runtime Events continuously displays runtime events detected by the OX Runtime Sensor, allowing you to begin investigating suspicious activity as soon as it occurs.
From a single interface, you can:
* Monitor runtime activity as new events are detected.
* Investigate runtime events across your cloud and Kubernetes environments.
* Identify the assets generating the highest number of runtime events.
* Detect unusual spikes in runtime activity over time.
* Filter events by runtime attributes such as cloud account, Kubernetes resources, processes, containers, images, and MITRE ATT\&CK tactics and techniques.
* Search for specific runtime events.
* Correlate events using the MITRE ATT\&CK framework.
* Drill down into detailed event information to understand what happened and determine the scope of an incident.
**To view Runtime Events:**
* In OX, select **Cloud > Runtime Events**.
The Runtime Events page displays the runtime events detected during the selected time period.
## Before you begin
> **Prerequisite:**\
> Runtime Events requires the OX Runtime Sensor to be installed and collecting runtime telemetry.
## Runtime Events dashboard
The dashboard summarizes the runtime events detected during the selected time period.
| Section | Description |
| ----------------------- | ---------------------------------------------------------------------------------------------------------- |
| **Time range** | Select the time period to investigate. |
| **Search** | Search the displayed runtime events. |
| **Top Affected Assets** | Displays the assets with the highest number of runtime events detected during the selected time period. |
| **Events Volume** | Displays the number of runtime events detected over time, helping you identify unusual spikes in activity. |
| **MITRE Tactic** | Displays the distribution of runtime events by MITRE ATT\&CK tactic. |
| **Events Log** | Lists the runtime events that match the current filters. |
| **Columns** | Select the columns displayed in the Events Log. |
## Events Log
The Events Log lists the runtime events that match the selected time range and filters.
By default, the table includes the following information.
| Column | Description |
| --------------- | ----------------------------------------------------------------------------- |
| **Date** | When the runtime event was detected. |
| **Event** | The detected runtime event. |
| **Process** | The process associated with the event. |
| **Target** | The network target or destination associated with the event, when applicable. |
| **Container** | The container in which the event occurred. |
| **Environment** | The cloud or Kubernetes environment where the event occurred. |
> **Note:**\
> Additional columns may be available depending on your environment and the selected event type.
## Filters
Use the filters to narrow the displayed runtime events.
| Filter | Description |
| ------------------------ | -------------------------------------------------------- |
| **Category** | Filter events by event category. |
| **MITRE Tactic** | Filter events by MITRE ATT\&CK tactic. |
| **MITRE Technique** | Filter events by MITRE ATT\&CK technique. |
| **Event** | Filter by the detected runtime event. |
| **Process** | Filter by the process involved in the event. |
| **Parent Process** | Filter by the parent process that initiated the process. |
| **Cloud Account** | Filter by cloud account. |
| **Cloud Region** | Filter by cloud region. |
| **Kubernetes Cluster** | Filter by Kubernetes cluster. |
| **Kubernetes Namespace** | Filter by Kubernetes namespace. |
| **Kubernetes Node** | Filter by Kubernetes node. |
| **Pod** | Filter by Kubernetes pod. |
| **Container** | Filter by container. |
| **Image** | Filter by container image. |
| **Image Tag** | Filter by container image tag. |
| **Container ID** | Filter by container ID. |
| **File / Connection** | Filter by the related file or network connection. |
> **Tip:**\
> Combine multiple filters to focus on a specific cloud account, Kubernetes workload, process, or MITRE ATT\&CK tactic during an investigation.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.ox.security/ox-cloud/ox-runtime-sensor/runtime-events.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.