AI Agent Activity
The AI Agent Activity report shows what AI agents did in a period: which agents each user ran, which models and servers they called, which tools they used, and what your guardrails blocked. Use it to review AI use across the organisation and to measure how your guardrails and filters work. Open it from Activity > Reports.
The report is built from the AI Edge events (AI allowed, AI blocked, AI redacted, AI redirected, AI detected) of every source: the Netzilo client on devices, coding-agent hooks, the Netzilo browser extension and the Netzilo AI Gateway. For requests, tokens and cost through the AI Gateway, use the AI Usage report.
Only administrators can open Activity. The report lists users by name and e-mail address, with the tools they called.
Create an AI Agent Activity report
- Go to Activity > Reports and click Create Report.
- Select AI Agent Activity as the Report Type.
- Choose the Date Range. The default is the last two weeks.
- Optionally pick Groups to limit the report to their users. Leave it empty for all users.
- Click Save.
The report appears in the table when it is ready, labelled AI Activity. Click the eye icon to view it, or the download icon to save it as a PDF. See Reports for the table and the dialog.
Overview
When the period has both kinds of activity, the report opens with two tabs:
- Users - AI activity of signed-in users.
- Agents - AI activity of peers that have no user, such as servers and CI runners added with a setup key. They are listed per peer.
Each tab starts with these figures:
| Figure | What it counts |
|---|---|
| Total Users (Peers on the Agents tab) | Users or peers with AI activity. |
| AI Agents | Distinct AI agents, such as coding agents, AI apps, sites in the browser and gateways. |
| Servers | Distinct servers called: model APIs and MCP servers. |
| Total Tool Calls | All checked calls: prompts, responses, tool calls and tool results. |
| Policy Violations | AI blocked events. |
Calls that were detected, redacted or redirected count as calls, not as violations.
The chart below the figures has three views:
- Agents - the share of calls per AI agent.
- Models - the share of calls per model.
- Servers - the share of calls per model API or MCP server.
User details
Below the chart, Users lists each user with their Tool Calls, Agents and Violations. Use Search for AI agent activity to find a user. Click a user to expand their details.
| Section | What it shows |
|---|---|
| Flow graph | The user, the agents they ran and the servers those agents called, with call counts. A warning badge marks a server with violations. Zoom in or open it full screen with the controls on the left. |
| Top Agents | The user's agents by number of calls. |
| Top Servers | The model APIs and MCP servers the user's agents called. |
| Top Calls | The most frequent calls, such as llm_request, llm_response and MCP tool names. |
| Violations | Every blocked call, newest first. |
The Violations table has these columns:
| Column | What it shows |
|---|---|
| Date/Time | When the call was blocked. |
| Category | Security, Privacy, Compliance or Prompt Injection. |
| Tool Call | The call and the server, for example llm_request on anthropic. |
| Blocked By | Guardrail. |
| Reason / Filter | The guardrail rule that blocked the call and the filter that applied it. |
Hover a violation to read the full sentence, for example "Tool call <tool> on <server> is
blocked because guardrail detected <rule> on tool request by filter <filter>".
Agents tab
The Agents tab shows the same figures and chart for peers without a user. Peers lists each peer with its Tool Calls, Agents and Violations; expand a peer for its top agents, servers, calls and violations. Use Search peers, agents, servers to find one.
Download the report
Click the download icon in the reports table to save the report as a PDF.
Use the API
Create the report with POST /api/reports and "report_type":"ai_activity". See
Reports.
Troubleshooting
The report shows No AI Agent Activities found. No AI Edge events were recorded in the period for the selected users. Check that the devices run the Netzilo client with an endpoint filter, that the browser extension is installed, or that traffic goes through the AI Gateway. Widen the date range or clear Groups.
Peers appear under Agents instead of Users. They were added with a setup key and have no user. This is expected; they are shown per peer.
A violation is missing from the report. Only AI blocked events are violations. AI detected (report mode), AI redacted and AI redirected count as calls. To block instead of report, change the rule's action in the guardrail.
Related Documentation
- Reports - Create, view, download and delete reports
- AI Usage - Requests, tokens and cost through the AI Gateway
- Events - The AI Edge events behind this report
- Guardrails - The rules that block, redact and detect
- Filters - Which guardrails apply to whom
- MCP - MCP servers and bundles behind the AI Gateway
- Behavior Graph & Kill Chains - Investigate a single session