> ## Documentation Index
> Fetch the complete documentation index at: https://developer.box.com/llms.txt
> Use this file to discover all available pages before exploring further.

# AI Security Detection Events

export const MultiRelatedLinks = ({sections = []}) => {
  if (!sections || sections.length === 0) {
    return null;
  }
  return <div className="space-y-8">
      {sections.map((section, index) => <RelatedLinks key={index} title={section.title} items={section.items} />)}
    </div>;
};

export const RelatedLinks = ({title, items = []}) => {
  const getBadgeClass = badge => {
    if (!badge) return "badge-default";
    const badgeType = badge.toLowerCase().replace(/\s+/g, "-");
    return `badge-${badge === "ガイド" ? "guide" : badgeType}`;
  };
  if (!items || items.length === 0) {
    return null;
  }
  return <div className="my-8">
      {}
      <h3 className="text-sm font-bold uppercase tracking-wider mb-4">{title}</h3>

      {}
      <div className="flex flex-col gap-3">
        {items.map((item, index) => <a key={index} href={item.href} className="py-2 px-3 rounded related_link hover:bg-[#f2f2f2] dark:hover:bg-[#111827] flex items-center gap-3 group no-underline hover:no-underline border-b-0">
            {}
            <span className={`px-2 py-1 rounded-full text-xs font-semibold uppercase tracking-wide flex-shrink-0 ${getBadgeClass(item.badge)}`}>
              {item.badge}
            </span>

            {}
            <span className="text-base">{item.label}</span>
          </a>)}
      </div>
    </div>;
};

export const Link = ({href, children, className, ...props}) => {
  const localizedHref = href;
  return <a href={localizedHref} className={className} {...props}>
      {children}
    </a>;
};

The `AI_SECURITY_DETECTION` event is generated when Box AI performs a security scan on input or retrieved content and detects a potential security risk, such as a prompt injection attempt. These events allow you to monitor and audit AI security detections across agent sessions and AI-powered workflows.

<Warning>
  AI security detection events are generated only for Box Agents. Legacy agents are not scanned. Box Shield Pro agents, including the <Link href="https://support.box.com/hc/en-us/articles/44263764561171-AI-Classification">AI Classification Agent</Link> and the <Link href="https://support.box.com/hc/en-us/articles/48430758923027-AI-Threat-Analysis">AI Threat Analysis Agent</Link>, are also not scanned.
</Warning>

All AI security detection events are produced within the <Link href="/guides/events/enterprise-events/for-enterprise">enterprise event</Link> stream. These events follow the standard <Link href="/reference/resources/event">event</Link> object schema, with `event_type` set to`AI_SECURITY_DETECTION` and detection-specific details nested inside `additional_details`.

```json theme={null}
{
  "created_by": {
    "type": "user",
    "id": "1234"
  },
  "created_at": "2026-01-01T00:00:00-08:00",
  "event_type": "AI_SECURITY_DETECTION",
  "type": "event",
  "session_id": null,
  "additional_details": {
    "ai_security_detection_event": {
      "agent_id": "box-ai-agent",
      "items": null,
      "detector_type": "PROMPT_INJECTION",
      "scan_source_type": "PROMPT",
      "confidence_level": "MEDIUM",
      "action": "ALLOW"
    }
  }
}
```

# `additional_details` fields

| Field              | Description                                                                    |
| ------------------ | ------------------------------------------------------------------------------ |
| `agent_id`         | The ID of the Box AI agent that processed the request.                         |
| `items`            | Always returns `null`.                                                         |
| `detector_type`    | Indicates what triggered the detection. See [Detector types](#detector-types). |
| `scan_source_type` | Indicates that the user's input to the agent was scanned.                      |
| `confidence_level` | Confidence level of the detection: `LOW`, `MEDIUM`, `HIGH`.                    |
| `action`           | The action taken after the detection. See [Actions](#actions).                 |

## Detector types

The `detector_type` field indicates what triggered the detection. Additional detector types may be added in the future.

| Detector type      | Description                                                                                                                                                        |
| ------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `PROMPT_INJECTION` | Box AI detected an attempt to manipulate or override agent instructions through malicious or adversarial input during an agent interaction or AI-powered workflow. |

# Actions

The `action` field indicates what Box AI did in response to the detection. All detections, including those with a `LOW` confidence level, are recorded in the enterprise event stream.

| Action     | Description                                                       |
| ---------- | ----------------------------------------------------------------- |
| `LOG_ONLY` | The detection was recorded. The request was permitted to proceed. |

<RelatedLinks
  title="RELATED APIS"
  items={[
{ label: "List user and enterprise events", href: "/reference/get-events", badge: "GET" },
{ label: "Get events long poll endpoint", href: "/reference/options-events", badge: "OPTIONS" }
]}
/>

<RelatedLinks
  title="RELATED GUIDES"
  items={[
{ label: "Get Enterprise Events", href: "/guides/events/enterprise-events/for-enterprise", badge: "GUIDE" }
]}
/>