Deckard Events and Alerting

Deckard sends what it finds to one destination: the Elasticsearch, Splunk HTTP Event
Collector or HTTPS webhook named in its config file. It sends two kinds of event there: one
per agent found, and one per scan.

Discovered agents

One event per agent per scan:

{
  "event_type": "arthur.discovery.agent",
  "schema_version": 1,
  "observed_at": "2026-10-07T18:00:00.123456+00:00",
  "source": {"id": "6b0f…", "name": "vertex-prod", "vendor": "gcp_vertex", "config_name": "agent-engines"},
  "agent": {
    "external_id": "projects/123456789012/locations/us-central1/reasoningEngines/111…",
    "name": "personal-assistant",
    "last_seen": "2026-10-07T17:58:12+00:00"
  }
}

Each agent event records which source found it (source), where it runs (agent.external_id,
here the Vertex AI project, region and Agent Engine), and when it was last seen
(agent.last_seen), so you can follow up with the team that owns it. agent also carries whatever else the source
reported, such as the models it calls and the tools it uses.

Deckard keeps no state between scans: each scan sends everything the source reports at that
moment, so the same agents arrive every time. To count each agent once, dedupe on
agent.external_id and source.id together: the pair identifies one agent as reported by
one source, so an agent that two sources both report is counted once per source.

Scan outcomes

Each scan also sends one arthur.discovery.scan_outcome event saying whether it succeeded,
how many agents it sent, and why it failed if it did. The top-level emit_scan_outcomes key
in the config file controls this; set it to false to turn these events off.

What to alert on

• A new agent.external_id: an agent nobody has seen before.
• outcome.succeeded: false: a source Deckard can no longer read. error_code says why
  (authentication_failed, permission_denied, …).
• A non-empty outcome.denied_scopes: the cloud projects or accounts, inside what the
  source was configured to scan, that refused the scan, so their agents are invisible. Grant
  the source's credential read access there.
• outcome.device_coverage.unreadable_devices: machines the scan could not read, such as
  ones the endpoint collector (Arthur's open-source script that lists the AI tools installed
  on a machine) has never reported from. Deckard has no inventory for these
  machines, so any agents on them go unreported until the collector runs there.

The configuration reference
lists every field of both events, with its type and when it is present, and how each
destination stores them.