Monitor activity

When you finish, you can confirm your agent's first tool call went through the gateway and see the policy decision behind it. Once agents are connected and making tool calls, the dashboard shows what they are doing.

DashboardCopy Anchor Link

The dashboard groups key metrics into themed cards:

• Gateway – total requests through the gateway, with the share of tool calls that executed successfully, a count of real errors (timeouts, upstream failures; policy blocks excluded), and how many calls were blocked
• Inventory – counts of agents, users, resources, and policies
• LLM usage – spend and tokens across your agents

Below the cards, a tool executions trend sits beside an LLM usage cost-over-time chart. The bottom row shows the top models by token usage, recent activity, and top blocked tools. The LLM widgets populate once agents report usage through OpenTelemetry.

Audit logCopy Anchor Link

Navigate to Agent Trail (Audit log) to see a real-time feed of every action. Each entry shows the timestamp, actor (user or agent), the resource and tool involved, and the outcome.

Events include tool executions, agent connections, policy changes, resource changes, and connection events. Metadata like IP address and browser appears inline on each entry. Entries that carry more detail (tool calls, agent connections, and configuration changes) expand: a tool call reveals the tool, resource, agent, policy decision and its reason, and any DLP redactions.

Use the filter bar to narrow the feed by Action, Agent Instance, Agent (for example, all Claude Code clients), MCP (the resource involved), User, Group, or tag.

Enforcement trafficCopy Anchor Link

For aggregated trends over time (tool usage, LLM token usage, and policy-enforcement metrics), open Enforcement Traffic. It has three tabs: MCP Usage, LLM Usage, and Security. Each tab's Download button exports its data as a CSV zip, scoped to the applied filters and date range.

See Enforcement traffic for a full breakdown of each tab, and OpenTelemetry for how to feed the LLM Usage tab with token data from Claude and Codex.

Next stepsCopy Anchor Link

You've completed the four-step setup. For deeper detail on today's activity, see the Audit log guide for filtering and use cases, and Enforcement traffic for trends over time.