Agent360 dashboard

Agent360 is the per-agent drill-down in the bundled Grafana stack. It answers three questions from one stable identity: what is this agent doing now, what did it call, and where did time, tokens, cost, or failures accumulate? New root agents and subagents appear automatically as hook events arrive; no dashboard file is generated per agent.

Open an agent

1. Start the local observability stack.
2. Open Grafana at http://localhost:3000.
3. Open DefenseClaw → Agent identity and select an Agent ID in Runtime Agent Directory.
4. The link opens DefenseClaw → Agent360 with the connector, stable agent identity, and time range carried into the dashboard.

You can also open Agent360 directly and use its variables:

Read the overview

The top of the dashboard is deliberately ordered from identity to health to execution detail:

The Execution phase timeline preserves sub-second ordering for lifecycle, model, and tool phases. Throughput and p95 latency show whether activity is increasing and which operation class is slow. Executions and last activity keeps the lifecycle and execution IDs visible so a resumed long-running agent does not look like an unrelated process.

Follow an enforced or alternative path

The Hook enforcement and recovery paths section answers a different question from the verdict list: what did DefenseClaw actually return to the agent, and what did the agent do next?

Each hook delivery emits a durable hook_decision record after connector capability and enforcement-mode mapping. It carries the same agent, root, lifecycle, execution, operation, trace, evaluation, and rule identifiers as the surrounding lifecycle, model, and tool records.

Start with a spike in Hook action outcomes over time, then read Decision → recovery path from top to bottom. Every row is scoped to the selected lifecycle and execution. The rows immediately after a decision are the observed path: a new tool call indicates an alternative tool attempt, a new prompt/model response indicates the agent reconsidered, another decision shows a retry, and a terminal lifecycle event shows that the session ended.

An enforced block does not guarantee that an agent retries; when no later row appears, DefenseClaw did not observe another hook event in that execution. It does not infer a retry from a missing signal.

Follow models, tools, destinations, and cost

The analytics row breaks the selected agent or tree down by:

• model calls and execution-lifetime p95 latency by provider/model;
• top tools, tool p95 latency, and website/network destinations;
• reported input/output tokens and reported cost by model and over time;
• lifecycle funnel, span error rate, latency heatmap, and active agents.

Use these panels together. A high tool count with a normal tool p95 usually means expected automation; a low call count with a high p95 points to a single blocking tool. A rising model-call count without turns completing points to a retry loop or an agent that is still active.

Inspect the dependency graph

The aggregate dependency map uses directed edges from agents to their observed dependencies:

• agent:* nodes are stable root or delegated agent identities;
• model:* nodes come from gen_ai.provider.name and gen_ai.request.model;
• tool:* nodes come from gen_ai.tool.name;
• agent-to-agent edges use the stable root/parent relationship.

The map is aggregated across the dashboard time range, so it answers what does this agent depend on? The per-trace Tempo graph answers a different question: what happened, in what order, for this one request? Use the aggregate map to find unexpected dependencies, then choose a trace to inspect the exact execution path.

Drill into logs and traces

The lower dashboard correlates all three local backends:

Select a Trace ID in Operation and enforcement traces. The data link preserves the selected connector, agent, scope, lifecycle, execution, and time range while replacing only the trace ID; it does not carry an empty trace variable. The selected-trace waterfall then shows the hook attempt alongside its child operation spans. If the trace is outside the current dashboard time range, widen the time picker before selecting it.

Interpret missing values correctly

Agent360 does not fabricate telemetry:

For example, Claude Code can expose completed model operations without reporting token or price fields for that hook. Agent360 shows model calls while leaving tokens and cost as Not reported. This is more accurate than estimating usage from message length. Older data collected before a schema or dashboard upgrade is not backfilled; generate a new turn after upgrading to validate newly supported fields.

Common investigation paths