Python runs

The Python runs page lists every program es-python has run on your machines, live and on record: what ran, on which machine, as which user, for how long, and whether it produced findings. Open it from Python runs in the sidebar, under Machines.

What the page shows

Each time a program starts under es-python, that is one run (see Runs for how runs relate to events). The page answers "what ran on this machine, and when?" without needing an event to start from.

From top to bottom:

The toolbar: the view (All runs or By machine, see By machine), the time range (24 h, 7 days, 30 days or Custom), a machine picker, and Export CSV.
The summary line: runs in the range, runs going on now, distinct programs, runs that produced findings, the median and 95th-percentile duration of ended runs, and new programs. Click a figure to filter the run list by it.
Running now, refreshed every 10 seconds.
Runs started, per hour for the 24 h range and per day for longer ones, split into runs that produced findings and clean runs. Show the numbers lists them as a table.
When runs start: a weekday by hour grid. Brighter cells had more runs.
Machines and Programs, then the list of Runs.

The charts and the weekday grid use UTC. The tables show times in your display time zone.

Running now

Running now lists the runs that are going on at this moment, newest check-in first. A running program checks in every 30 seconds; Last check-in shows how long ago it last did, and its bar empties as the run gets close to being counted as ended. Up for is how long the run has been going.

The list refreshes every 10 seconds while the page is open in a visible tab, and pauses when you switch away.

Statuses

Every run has one status:

Running: the run has checked in within the last 75 seconds.
Starting: the run has just started and has not yet sent its first 30-second check-in.
Ended: the run checked in while it ran and has since stopped. Its duration is accurate to about 30 seconds.
Finished in under 30 s: the run ended before its first 30-second check-in.
Start only: not followed after it started. It ended within 30 s, or no taint sources are on. Turn a source on in Configure to see how long its runs last.
From events: the machine reported the run only on the events it produced. See Update a machine.

A program that daemonizes (forks, then the parent exits) stops sending check-ins when the parent exits, so it shows as Ended, Finished in under 30 s or Start only while its child keeps running.

Programs

A program is what a run started: a script path, a module (-m pip), inline code for -c, or interactive for a Python prompt. The table shows the ten busiest (five on a phone); Show all lists the rest. Click a program to list only its runs, and click it again (or the × on its filter) to go back to every run.

Badges point out runs worth a second look:

New: the program first ran on a machine inside the selected range. History reaches back 13 months.
Package install: pip install or uv pip install.
Interactive: a Python prompt rather than a script.
Root: at least one run was started by the root user.

A row reading Command line hidden counts runs from machines that do not send their command line.

Machines

The Machines table shows each es-python machine's runs in the range, runs going on now, distinct programs, the last run and the runs that produced findings. Click a machine to narrow the whole page to it, the same as choosing it in the machine picker.

Up and Down

Each machine in the Machines table, on its card under By machine and in the bar over one machine shows Up or Down. Up means it runs as configured; Down means EyalSec is not watching it and it is not billed. Click the switch to change it. It is the same switch as on the Machines page: see Turn a machine off and on. A machine that is Down reports no runs.

By machine

By machine in the toolbar shows one card per es-python machine instead of the whole account at once. Each card has the machine's runs in the range, runs that produced findings, distinct programs, a small chart of runs started over the range, the last run, and how many runs are going on now (refreshed every 10 seconds). Sort orders the cards by runs, findings, latest run or name; with more than six machines, Find a machine narrows them by name.

Click a card to open that machine alone: the same summary, Running now, charts, Programs and run list as above, holding only that machine's runs. All machines (or your browser's Back) returns to the cards, Events opens the machine's events and Configure its settings. All runs goes back to the whole account.

The run list

The run list shows the runs in the range, newest start first. More load as you scroll, or with Load more. Narrow it by text in the command line, status, findings, user, program or machine; the filters are kept in the page address, so a link opens the same view.

Click a run to open its details: the full command line with Copy, the machine, user, working directory, process id and Python version, its check-ins, and its environment when the machine sends it. Open this run's events opens the events page narrowed to that run (a run filter).

Notes under the summary

Command line hidden by this machine's settings: the machine does not send command lines. Configure opens its settings, where Command line turns them on.
Update this machine to see every run: see Update a machine.
N more runs were counted but not listed: a machine started runs faster than the list keeps them. The figures and charts include every run; the list leaves those out.

Update a machine

A machine installed before this page existed reports a run only when that run produces an event, so quiet runs are missing. Reinstall it to see every run.

Export

Export CSV downloads the run list with the filters and range you have set: start time, machine, status, program, command line, user, working directory, process id, Python version, duration, events, worst severity and run id. An export holds up to 50,000 runs; a larger one ends with a row starting TRUNCATED, so narrow the range or the filters for the rest.

How long runs are kept

Runs are listed for 30 days. The counts behind the summary, the charts and the New badge are kept for 13 months, so a range longer than 30 days still counts every run but lists only the recent ones.