Live traffic
Overview
Section titled “Overview”Discover → Live traffic (/traffic) draws one map of what is calling what across your organisation, as it happens. On one side are the origins of traffic:
- Agents: services instrumented with a Shield360 or OpenTelemetry SDK.
- Computers: Windows, macOS and Linux machines running the Shield360 collector. A computer brings the coding agents running on it, the AI usage the collector reads from disk, the AI sites used in a browser, and the processes seen calling AI provider APIs.
On the other side are the targets they reached:
| Kind | What it is |
|---|---|
| Models | The model an LLM call asked for, or the model the provider answered with |
| Tools | Each tool named on a call |
| Databases | The database system and name of a database call |
| Hosts | The remote host of any other outbound call |
| AI services | An AI provider’s API or an AI site. A host such as api.openai.com is shown as an AI service rather than a plain host |
| Agents | Another agent: the service a call went to, or the agent a hand-off went to |
The map reads every project database you can already open, so it shows the whole organisation rather than only the current project. Only names, counts, timings, tokens, cost and ids are shown. Prompts, completions, URLs and other content never reach this page.
Who can see it
Section titled “Who can see it”| Permission | What it adds | Held by |
|---|---|---|
observability.read (View telemetry) | The page, agents and their targets | Owners, administrators, analysts, the Security role, members and viewers |
collector.read (View computers and people) | Computers, and the people using them | Owners, administrators, compliance officers, analysts, the Security and Finance roles, members and viewers |
inspection.view, compliance.dataprotection.view, compliance.injection.view, compliance.read | Sensitive-data, guard, prompt-injection and policy violations in the Violations panel | Each kind is shown only to roles that may open its own page |
Without View computers and people, the page says Your role can’t view computers and people, so only agents are shown.
Which databases are read is decided on the server. A project database is included only when its project belongs to your current organisation, you are a member of that project, and you have access to that database configuration: exactly the databases you could open by switching project in the header.
Read the map
Section titled “Read the map”The header shows Live and the time of the last update, and how many project databases were read. If a database did not answer, the count says how many are unavailable. If part of the detail (the activity feed, violations or computers) took too long for the window, it says how many are incomplete. A shorter window usually gives the full picture.
Under Window, pick Last minute, Last 5 minutes, Last 15 minutes, Last hour, Last 6 hours, Last 24 hours or Last 7 days. The map refreshes on its own:
| Window | Refreshes every |
|---|---|
| Last minute, 5 minutes, 15 minutes | 5 seconds |
| Last hour | 15 seconds |
| Last 6 hours | 30 seconds |
| Last 24 hours | 1 minute |
| Last 7 days | 5 minutes |
Select Pause to hold the current picture and Resume to carry on. If a refresh fails, the page shows Lost the connection. Retrying… and tries again, waiting longer after each failure.
- Show: agents, computers, or both.
- Projects: one project, or All projects.
- The kind chips: show or hide models, tools, databases, hosts, AI services or agents.
- Fan out: Off, 1 level or 2 levels. Fan-out opens a target into what was used inside it. For example, a tool opens into the programs a command ran, the folders a file tool touched or the domains a fetch reached. A database opens into its operations, a host into its HTTP routes, and a model into the kind of operation.
The side panel shows its numbers: calls, errors, tokens in and out, and cost. For an origin it lists what it Talks to, and for a target it lists what it is Used by.
From there, Open agent opens the agent’s page and Open its traffic map opens that agent’s Traffic tab. For a computer, Open computer opens the computer’s page. If the agent or computer belongs to another project, the panel says so. Switch to that project in the header to open it.
Double-click a node for its details over the window: calls, errors, error rate, traces, p50 and p95 latency, tokens, cost, the first and latest call, calls over time, what it talks to or is reached by, its operations, and the latest calls. Select a counterpart to see only the calls with it.
A computer’s details also show the machine, OS, user, collector version and last check-in. They also show the coding tools and models used on it, the AI sites used in the browser, the processes calling AI APIs, and its coding sessions.
On the map you can drag a node to move it, double-click it for details, and click empty space or press Esc to clear the highlight. Reset layout puts the nodes back where they started.
Activity and violations
Section titled “Activity and violations”The Activity feed lists the latest calls in the window. The Violations panel lists violations from the same window by source (Sensitive data, Guard, Prompt injection and Policy), each tied to the agent or computer it came from where possible. Others are listed as Not tied to an agent or computer. Select one to open it.
Replay a window
Section titled “Replay a window”Select Replay to play back the window’s calls one by one, in order. Choose how long the playback takes with Play over, and use Play, Pause, Play from the start and the position slider to move through it. If the window had more calls than a replay carries, it plays back the most recent ones. Close replay returns to the live map.