Activity File events
File events
A file event is one change to an AI artifact on a machine, recorded by the agent when it scans: the artifact was discovered, its content changed, it disappeared, it returned, or it moved out of or back into a scanned root. The page has two tabs. Events lists the changes. Scans lists the scan runs that reported them.
Who can do it
Reading both tabs needs machines:read, which every role holds: Owner, Admin, Analyst, Policy author, Fleet operator and Compliance reader. The page changes nothing.
Read the file events
- Open Activity › File Events. The Events tab opens first.
- Search by artifact name with Search artifact name.
- Filter by Event, Category, Machine and When.
- Select a row. The title reads the event and the artifact, such as "Content changed" followed by the artifact's name.
Kinds of file event
| Event | Meaning |
|---|---|
| Discovered | A scan found the artifact for the first time. |
| Content changed | Its content hash differs from the last scan. |
| Disappeared | The last scan did not find it. |
| Returned | It was found again after disappearing. |
| Out of scope | It is still there but no longer inside a scanned root. |
| Back in scope | It is inside a scanned root again. |
What the inspector shows
| Field | Meaning |
|---|---|
| Machine | Where it happened. |
| When | When the event was recorded. |
| Scan | The scan run that reported it, or Not recorded. |
| Artifact ID, Event ID | The identifiers. |
| The change | For Content changed, Before and After hashes. Other kinds show one Hash. |
Links open the artifact in AI artifacts, the scan that reported the event, and the machine.
Scans
- Choose the Scans tab.
- Filter by Kind, Outcome, Machine and When.
- Select a run.
| Column | Meaning |
|---|---|
| When, Machine | When the run was received, and where. |
| Kind | Smart walks what the watch store says changed. Full walks everything. |
| Outcome | In progress, Completed, Partial or Failed. |
| Found | What the run changed, such as discovered and content-changed counts. A quiet completed run reads "Nothing new". |
| Took | How long the run took. |
Add more columns from the column menu: Discovered, Content changed, Disappeared, Returned, Out of scope, Unchanged, Rejected, Roots, Files seen, Artifacts reported, Scope version, Run ID.
In progress is not an error. A run is open until its closing report arrives, so it is either still walking the disk or the machine stopped mid-scan. The row's time tells you which. Partial means some roots were walked and some were not. A run that did not complete never says "Nothing new". It says "Nothing yet", "Nothing reported" or "Nothing where it reached".
The scan inspector has the sections What changed and What it walked. It also links to What this scan found and to the machine's file events. A start or finish that was not reported reads Not reported or Still running.
When it goes wrong
| You see | It means |
|---|---|
| No file events yet, "An agent records one when an AI tool reads or writes a file it watches." | No agent has reported a change. |
| "An agent records a scan each time it walks the folders it watches." | No scan has been received. A link opens coverage. |
| "Could not load file events" | The Events tab could not be read. |
| "Could not load this event." / "Could not load this scan." | The one you opened failed to load. |
| "Could not load more events." / "Could not load more scans." | The next page failed. |
| "Machines are named by ID: the fleet could not be loaded." | The list works but shows machine IDs instead of names. |
With the API
File events and scans are in the Activity reference. An API key needs machines:read.