The Results page is where you review the events that Cannon runs produced. Each prompt sent through a run becomes an event here, with the signals detected on it and the action taken. You can look at the results of a single run, the results for a collection, or everything across runs, and open any event for full detail. You reach Results from the Cannon navigation, by clicking a completed run on the Runs page, or from a collection. Opening it from a run or a collection filters the table to that run or collection.

Reading the Event Table

The event table displays one row per event. It is the surface for working through run results: scanning for the events that were flagged, then opening any one of them in full. The table is highly configurable, so most reviewers work with a subset of columns suited to what they are looking for. The columns fall into a few groups based on what they tell you.

By default, a core set of columns is shows and the rest are hidden. You can enable or disable any column, reorder the visible ones, and save named layouts. The table below lists which columns are shown out of the box and which are hidden until you add them.

Identifying an Event

These columns tell you what an event is and where it came from.

• ID and Time: The event ID and the timestamp.
• Event Source: The participant type that initiated the event, such as agent or tool.
• Event Target: The participant type that received the event.
• Sender: The named participant that sent the event.
• Receiver: The named participant that received the event.
• User: The authenticated user associated with the event.
• Use Case: The use case the event belongs to.
• Profile: The profile that evaluated the event.

Assessing Risk and Outcome

These columns surface whether an event raised any concerns and what was done about it. They are the ones to scan first when reviewing results.

• Indicator: A red line if the event has Safety or Security alerts, or a yellow line if the event was modified. The column is empty when there are neither.
• Safety: A green check mark when there are no Safety alerts, or the count of alerts when there are.
• Security: A green check mark when there are no Security alerts, or the count of alerts when there are.
• Input Action: The action taken on the input: blocked, modified, or none.
• Output Action: The action taken on the output: blocked, modified, or none.
• Session Status: The status of the session the event belongs to: successful, blocked, internal error, model error, or no status.

Reviewing Content

These columns show what was actually said and what was detected in it.

• Input: The input content of the event.
• Output: The output content of the event.
• Input and Output: The input and output content shown together.
• Intent: The detected intent of the event.
• Sentiment: The detected sentiment of the event.

Timing and Processing

These columns report how long the event took to process and how large it was.

• Input Analysis Duration: The time spent analyzing the input.
• Output Analysis Duration: The time spent analyzing the output.
• LLM Duration: The time spent on the model analysis.
• Input Token Count: The number of Aiceberg tokens in the input, which are counted differently from LLM tokens.
• Output Token Count: The number of Aiceberg tokens in the output, which are counted differently from LLM tokens.

Navigating and Collecting Events

These columns are controls rather than event data.

• Session: A button that opens the Session table for the interaction the event belongs to.
• Selector: A checkbox for selecting events. Selected events can be copied to a collection with the Collections button.
• Bookmark: Whether the event is bookmarked.

Filtering

The filter panel narrows the table to the events you want. Alongside the standard filters, the Results page has two filters specific to Cannon: an All Collections dropdown and an All Runs dropdown, which scope the table to a single collection or a single run.

The filter panel offers these categories:

• Selectors: Use Case and Profile
• Time Range: A From and To window.
• Input and Output: Actions, Categories, and Signals, applied to the input, the output, or both.
• Sentiment: The detected sentiment.

Filters can be saved as named presents, then loaded or deleted form the filter panel.

Event Detail Panel

Clicking an event row opens the event detail panel, which shows the full detail for a single event: the prompt and response, the Input and Output Context, the signal results, and the Tool Inspector. This is the same panel used to review events elsewhere in the platform.

Reporting a Signal

The panel includes a Report feature for signals in the toolbar. When it is active, a report control appears next to each signal in the Input and Output Context section. Clicking a report control opens an optional note field, where you can add a note and submit the report. The report is sent to the team for review, and a green confirmation message appears after you submit.

Table Settings

Table settings control how the table is displayed. You can enable or disable columns, drag to reorder the visible columns, save named layouts, and set how many rows appear per page. Rows per page accepts a value from 1 to 500.