Runtime monitoring

Know what your AI is doing. Down to the host.

Traditional APM tools were built for request-response services. They track HTTP status codes and p99 latency. They do not understand coding-agent sessions, model calls, or tool chains.

Octic observes AI where it runs. Agentic Coding Insights reports Claude Code and Codex sessions from every host with an Octic sensor, and kernel-level sensors watch the AI processes on each host. The Octic SDK, coming soon, will report AI activity inside your own applications.

01 — What Octic observes

Four sources, one runtime picture.

Coding-agent sessions

Agentic Coding Insights reports Claude Code and Codex sessions from every host with an Octic sensor: the prompts, the spend, and the category of work. More coding agents are coming.

AI in your applications

Coming soon

The Octic SDK will report the AI activity inside your own applications, so runtime activity will sit on the same map as everything Octic discovers.

Host activity

Kernel-level sensors on Linux and Windows hosts see the AI apps, packages, and processes running there. The depth that powers discovery also powers observability.

Personal accounts

Sessions on personal, non-corporate Claude or Codex accounts are flagged, so you know when work runs outside the accounts your company manages.

Industry data

Organizations with security AI and automation detect and contain incidents 98 days faster on average.

IBM Cost of a Data Breach Report, 2024

02 — How it works

Runtime intelligence, not runtime logs.

Continuous, not periodic

Traditional monitoring runs on a schedule. Daily scans. Weekly reports. Quarterly audits. By the time a report surfaces, the landscape has shifted.

Octic observes continuously. Sensors report coding-agent sessions as they happen and watch the AI processes on each host. When the Octic SDK ships, it will report AI activity from your applications as it runs, too. This is runtime observability, not a retroactive postmortem.

Context, not just counts

A log line tells you something happened. Context tells you why it matters: which engineer ran the session, what they asked for, what it cost, and which category of work it went to.

Coming soon: for AI inside your own applications, SDK telemetry will land next to each resource's owner and trust state, and the agent run explorer will let you inspect individual runs.

Preview the agent run explorer

From signal to finding

Observability without response is just a dashboard. When Octic finds a problem, such as a policy violation or a session on a personal account, it opens a finding with an owner, an SLA, and an event history.

Coming late 2026, remediation agents will propose a specific fix: quarantine a flagged AI agent, revoke credentials, update a policy. Nothing will run until someone on your team approves it.

How remediation works

03 — Go deeper