Skip to main content
Activity is the timeline of MCP tool calls and security events. Hub shows synced records from every linked device. The local ultra dashboard shows the same page for this device. Open Observe → Activity, or the Activity page in the local dashboard. Search by action, rule, connector, agent, user, or device. Export the filtered table as CSV or JSON — see Exporting table data. The table shows Action, Outcome, Connector, Agent, User, Duration, and Time. Each record is its own row. Click a row to open it:
  • Tool calls: /activity/action/<id>
  • Other events: /activity/event/<id>
The address bar is the shareable link. Copy link copies it. Tool-call pages include request/response JSON, trace ID, errors, identity, device, and Govern this tool.

​
Filters

​
Outcomes

For pipeline layers, Hub sync, OTLP export, and recorded fields, see Observability overview.