Beyond the high-level picture on the Overview page, Shadow AI provides four tables for working through detected AI activity in detail. Events lists the individual detected events, Services lists the AI services in use, Users lists the people associated with the activity, and History lists past detection runs.

Events, Services, and Users share a common pattern. Each can be filtered by category, subcategory, and service, searched with a free-text field, and scoped by a time range control. History can be sorted by date. All four tables are paginated, and rows are not clickable.

Events

The Events table lists the individual AI events that were detected. It includes the following columns:

• Date: When the event occurred.
• Risk: The risk level of the event, shown as an icon. Two red up arrows indicate high risk, one orange up arrow indicates medium risk, and one blue down arrow indicates low risk.
• Category: The category the event was classified under.
• Subcategory: The subcategory the event was classified under.
• Username: The username associated with the event.
• Email: The email address associated with the event.
• Source IP: The source IP address of the event.
• Destination Domain: The destination domain the event was sent to.
• URL: The URL associated with the event.
• Destination: The destination of the event.
• Provider: The detected service provider.
• Integration: The integration the event came through.

The page also includes an Event Volume chart, which plots event counts across the selected time range with separate series for all events and high-risk events. The carts can be hidden or shown with a toggle.

Services

The Services table lists the AI services detected in your activity, with a count of services shown above the table. It includes the following columns:

• Category: The category the service belongs to.
• Subcategory: The subcategory the service belongs to.
• Service: The detected service. A secondary identifier, such as a user-agent string, domain, or label, may appear beneath the service name.
• Events: The number of events attributed to the service.
• Data: The volume of data attributed to the service.
• Users: The number of users associated with the service.
• Unidentified IPs: The number of unidentified IP addresses associated with the service.

Users

The Users table lists the users associated with detected AI activity. It includes the following columns:

• User ID: The identifier for the user. Activity not tied to a known account may appear under an identifier such as "unclaimed_ip_addresses."
• Usernames: The usernames associated with the user.
• IP Addresses: The number of IP addresses associated with the user.
• Events: The number of events attributed to the user.
• Data Transferred: The volume of data attributed to the user.
• Blocked Events: The number of the user's events that were blocked.
• High Risk Events: The number of the user's events classified as high risk.
• Services: The number of services the user accessed.

History

The History table lists past Shadow AI detection runs. Each row is one run, identified by its date. It includes the following columns:

• Date: When the run occurred.
• AI Services Detected: The number of AI services detected in the run.
• Total Events: The total number of events in the run.
• High Risk Events: The number of high-risk events in the run.
• Blocked Events: The number of blocked events in the run.
• Unique Users: The number of unique users in the run.
• Unclaimed IP Addresses: The number of unclaimed IP addresses in the run.
• Data Transferred: The volume of data moved in the run.