Skip to main content

Analytics Data Sources

Open Monitor > Analytics > Data sources to connect the sources that supply agent activity, skills, commands, and AI discovery data. Gateway activity appears automatically; agent telemetry and hook events require their own setup.

Start with the source card​

The page separates Connect OTLP from Enable hooks. Each card names the supported agents, the data it collects, and the action that opens its setup.

CardData shown on the cardWhere to start
Willow Scanner AgentInstalled agents, MCP servers, skills and commands, device identity, and native telemetryOpen AI Discovery
Claude CoworkMessages, model responses, tool usage, API requests, and errorsConfigure Cowork observability in Anthropic Admin settings
Claude Code ProfileActive time, token usage and cost, commits and pull requests, skills, and optional messagesConfigure profile
CodexDiscovery, native telemetry, and guard decisionsUse the scanner or manual Codex configuration for telemetry and Open Guards for hooks
Willow Guard HooksMessages, skills and commands, MCP prompts, and guard decisionsUnder Enable hooks, select Open Guards

If Analytics shows no data​

Each source card shows the connection values and configuration instructions for its agent. Enable collection in Willow and configure the agent on each reporting device.

If you only see Overview on Analytics, open Data sources to check which sources still need setup. Explore and Dashboards also depend on the logs read store, and only offer the audit logs dataset unless ClickHouse serves the organization; see Explore.

How agent telemetry reaches Willow​

Claude Code, Cowork, and Codex have their own OpenTelemetry exporter. Once configured, the agent sends OTLP over HTTP (JSON) straight to your organization's Willow connect URL. No Willow software has to run on the machine for this; the Scan Agent is one way to write the configuration, not a requirement.

AgentWillow endpointTelemetry toggle
Claude Codehttps://{org-connect}/otlp/claudeClaude Code
Claude Coworkhttps://{org-connect}/otlp/claudeClaude Code
Codexhttps://{org-connect}/otlp/codexCodex
CursorUploaded by the Scan AgentCursor

Every request carries Authorization: Bearer <org token>. The exporters append /v1/logs, /v1/metrics, and /v1/traces to the endpoint themselves. The setup values on each source card already include your connect hostname and token.

Willow matches each event to a user by the email the agent reports. Events with no matching user are stored without attribution.

Configure a source​

Willow gateway activity appears automatically. Agent telemetry takes two steps: turn collection on in Willow, then configure the agent.

Turn on collection first​

For a guided setup and first-event check, follow Set up and check agent telemetry. Runtime also links directly to the same collection controls under AI Discovery Settings > Agent telemetry.

Open Admin > Settings > Log Settings > Collect Agent Telemetry and turn on each agent you want to collect. Willow accepts telemetry only for enabled agents. Cowork uses the Claude Code switch.

Claude Code​

  1. Select Configure profile on the Claude Code Profile card.
  2. Add the Willow telemetry (OTLP) add-on to a policy. Add Capture telemetry content too if you want prompts, responses, and tool output.
  3. Export and deploy the policy through MDM or managed settings. For a local test, use Install for me.
  4. Restart Claude Code.

Claude Code sends metrics and events: active time, cost, tokens, commits, pull requests, and native skill events.

Claude Cowork​

Cowork does not read Claude Code policies. It requires an Anthropic Team or Enterprise plan.

  1. Copy the endpoint, http/json protocol, and authentication header from the Claude Cowork card.
  2. Paste them into Anthropic Admin settings > Cowork > Observability and save.
  3. Start a new Cowork session.

Cowork sends messages, model responses, tool usage, API requests, and errors.

Codex​

Codex does not read Claude Code policies. Expand Configure Codex manually on the Codex card and copy the [otel] block; your org token is already in it. Deploy it one of three ways:

  • Single machine: paste the block into ~/.codex/config.toml and restart Codex.
  • Team or organization (managed settings): distribute the same block as Codex managed settings — a managed_config.toml pushed via macOS MDM (the com.openai.codex domain, key config_toml_base64), or written to /etc/codex/managed_config.toml (Linux/macOS) or %ProgramData%\OpenAI\Codex\ (Windows). Managed defaults apply at launch and take precedence over the user's ~/.codex/config.toml. Because users can override managed defaults mid-session, add a matching hook in the admin-enforced requirements.toml if you need telemetry to stay on.
  • Automatically: let the Willow Scan Agent configure it.

Codex sends logs, metrics, and traces.

Willow Scan Agent​

Optional. On managed devices, the Scan Agent discovers installed AI agents, MCP servers, skills, and commands, and writes the telemetry configuration for every agent whose toggle is on:

  • Claude Code and Codex: the same native exporter configuration as above.
  • Cursor: Cursor has no native OTLP export, so the agent installs a Cursor hook that buffers events locally and uploads them in batches. Cursor telemetry requires the Scan Agent, and Willow must also enable it for your organization; ask Willow Support.

The Scan Agent leaves alone any agent that already exports to a collector other than Willow's.

Willow Guard Hooks​

Open Control > Guards > Setup & Coverage and select Configure in AI Discovery beside the coding agent. Under Guard hooks, choose its hooks and tool matchers, then enable the platform. The Scan Agent applies the configuration on each device. Hook events include prompts, tool activity, and guard decisions; Claude Code can also report skill and slash-command use. See Guard Hooks.

Send telemetry through your own collector​

To filter or enrich telemetry before Willow stores it, turn on OTLP proxy. Claude Code policies, Codex config, Cowork values, and the Scan Agent then point at your collector, which forwards to the endpoints above.

Troubleshooting​

  • Agent configured, but no data: check that the agent's switch is on under Collect Agent Telemetry. Willow returns 403 for agents that are off.
  • Data arrives without a user: the email the agent reports does not match a Willow user.
  • Prompt text is missing: turn on Log Content in Log Settings, and for Claude Code add Capture telemetry content to the policy.

Hook events and telemetry​

OpenTelemetry and Guard Hooks collect different kinds of events. Use the source cards to decide which data you need: native telemetry reports agent usage, while hooks capture lifecycle events and guard decisions.

Willow Guard Hooks source card with supported agents, collected events, and Open Guards
On this page