Activity log
The event stream from every endpoint client. Each row is one detection: who, on what device, in which AI application, which categories fired, what action was taken, and how severe it was. Filters narrow by severity, application, department, and time window. Filter state is carried in the URL, so a filtered view is a link you can paste into a ticket or an email.Remember what is not here: the prompt text. A row tells you that a credit-card pattern was redacted in ChatGPT at 14:32 by a named user on a named device. It does not, and cannot, show you the number. See Data handling.
Deployment and fleet health
The page that closes the trust gap mid-evaluation — proof the agent is running where it is supposed to, on the version you expect.
The offline list carries prose context per device — offboarded on a date, asleep for nine days, and so on — because the reason a machine is dark is usually more useful than the fact that it is.
Reconciling coverage
Cross-check this against your MDM roster. Devices where the policy applied but the client never checked in are the real gap.
Coaching and adoption
The product’s stated posture is teach, don’t block. Coaching is where you see whether that is working: which nudges are delivered most often, which departments improve, and whether repeat offences fall over time. This is usually the most persuasive page for a non-technical audience, because it reframes the deployment from surveillance to enablement — the numbers show people learning rather than people being caught.Audit and report
Generates a report you can take upstairs: framework coverage, activity over a chosen window, and a PDF export.1
Choose the window
A 30-day window is the common default for a management update.
2
Confirm the scope
Which departments, applications, and frameworks the report covers.
3
Export
Produces a PDF with a print stylesheet designed for the page, not a screenshot of a dashboard.
Forwarding to Microsoft Sentinel
Events can be pushed into your SIEM asPromptShieldsActivity_CL:
- Logs Ingestion API with a custom Data Collection Rule for the event stream
- Microsoft Graph Security API to promote high-severity events into first-class Sentinel incidents
Sentinel setup, guarantees, and KQL
The two-channel design, the Azure resources you need to create, delivery guarantees, and a verification query.
Exporting your AI estate to Ardoq
For organisations running Ardoq’s AI Lens, the console generates a nine-file CSV import bundle from its own inventory — applications, people, org units, data stores, technology products and services, compliance assessments, and the relationships between them. Inventory metadata only; no prompt data is included.Full file list and setup
See Integrations for the complete bundle contents.
Discovering shadow AI
Detection events also feed a discovery view, which surfaces AI tools in use that nobody registered. In practice this is where most organisations get their first genuine surprise: the count of distinct AI applications in daily use is almost always higher than the count anyone would have guessed. Three discovery routes feed it:- Manual registration — someone declares a use case
- Browser telemetry — the extension reports which AI sites are actually visited
- Endpoint detection — the desktop agents report AI applications running natively
A monthly rhythm that works
1
Weekly — skim the activity log
Filter to high severity. You are looking for patterns, not individual rows.
2
Weekly — check fleet health
Chase the offline list before it grows into a project.
3
Monthly — pull the 30-day report
Same window every month so the trend line means something.
4
Quarterly — revisit policies
Look at false-positive rates. Policies that have been quiet and accurate for a quarter in Guideline mode are candidates for promotion to Strict.