Skip to main content

Analytics Data Sources

Open Monitor > Analytics > Data sources to connect the sources that supply agent activity, skills, commands, and AI discovery data. Gateway activity appears automatically; agent telemetry and hook events require their own setup.

Start with the source card​

The page separates Connect OTLP from Enable hooks. Each card names the supported agents, the data it collects, and the action that opens its setup.

CardData shown on the cardWhere to start
Willow Scanner AgentInstalled agents, MCP servers, skills and commands, device identity, and native telemetryOpen AI Discovery
Claude CoworkMessages, model responses, tool usage, API requests, and errorsConfigure Cowork observability in Anthropic Admin settings
Claude Code ProfileActive time, token usage and cost, commits and pull requests, skills, and optional messagesConfigure profile
CodexDiscovery, native telemetry, and guard decisionsUse the scanner or manual Codex configuration for telemetry and Open Guards for hooks
Willow Guard HooksMessages, skills and commands, MCP prompts, and guard decisionsUnder Enable hooks, select Open Guards

Analytics Data Sources showing the Willow Scanner Agent, Claude Cowork, and Claude Code Profile cards, with the Cowork card listing its OTLP endpoint, protocol, and headers

If Analytics shows no data​

OpenTelemetry is available to every organization, so each card shows its setup values right away. Follow the configuration instructions on the source card — opening the Data Sources page alone does not configure an agent on a developer machine.

If you only see Overview on Analytics, open Data sources to check which sources still need setup. Explore and Dashboards also require ClickHouse to serve the organization; see Explore.

How agent telemetry reaches Willow​

Claude Code, Cowork, and Codex have their own OpenTelemetry exporter. Once configured, the agent sends OTLP over HTTP (JSON) straight to your organization's Willow connect URL. No Willow software has to run on the machine for this; the Scan Agent is one way to write the configuration, not a requirement.

AgentWillow endpointTelemetry toggle
Claude Codehttps://{org-connect}/otlp/claudeClaude Code
Claude Coworkhttps://{org-connect}/otlp/claudeClaude Code
Codexhttps://{org-connect}/otlp/codexCodex
CursorUploaded by the Scan AgentCursor

Every request carries Authorization: Bearer <org token>. The exporters append /v1/logs, /v1/metrics, and /v1/traces to the endpoint themselves. The setup values on each source card already include your connect hostname and token.

Willow matches each event to a user by the email the agent reports. Events with no matching user are stored without attribution.

Configure a source​

Willow gateway activity appears automatically. Agent telemetry takes two steps: turn collection on in Willow, then configure the agent.

Turn on collection first​

Open Admin > Settings > Log Settings > Collect Agent Telemetry and turn on each agent you want to collect. This switch is the only gate: while an agent is off, Willow rejects its telemetry even when the agent is configured correctly. Cowork uses the Claude Code switch.

Claude Code​

  1. Select Configure profile on the Claude Code Profile card.
  2. Add the Willow telemetry (OTLP) add-on to a policy. Add Capture telemetry content too if you want prompts, responses, and tool output.
  3. Export and deploy the policy through MDM or managed settings. For a local test, use Install for me.
  4. Restart Claude Code.

Claude Code sends metrics and events: active time, cost, tokens, commits, pull requests, and native skill events.

Claude Cowork​

Cowork does not read Claude Code policies. It requires an Anthropic Team or Enterprise plan.

  1. Copy the endpoint, http/json protocol, and authentication header from the Claude Cowork card.
  2. Paste them into Anthropic Admin settings > Cowork > Observability and save.
  3. Start a new Cowork session.

Cowork sends messages, model responses, tool usage, API requests, and errors.

Codex​

Codex does not read Claude Code policies. Expand Configure Codex manually on the Codex card and copy the [otel] block; your org token is already in it. Deploy it one of three ways:

  • Single machine: paste the block into ~/.codex/config.toml and restart Codex.
  • Team or organization (managed settings): distribute the same block as Codex managed settings — a managed_config.toml pushed via macOS MDM (the com.openai.codex domain, key config_toml_base64), or written to /etc/codex/managed_config.toml (Linux/macOS) or %ProgramData%\OpenAI\Codex\ (Windows). Managed defaults apply at launch and take precedence over the user's ~/.codex/config.toml. Because users can override managed defaults mid-session, add a matching hook in the admin-enforced requirements.toml if you need telemetry to stay on.
  • Automatically: let the Willow Scan Agent configure it.

Codex sends logs, metrics, and traces.

Willow Scan Agent​

Optional. On managed devices, the Scan Agent discovers installed AI agents, MCP servers, skills, and commands, and writes the telemetry configuration for every agent whose toggle is on:

  • Claude Code and Codex: the same native exporter configuration as above.
  • Cursor: Cursor has no native OTLP export, so the agent installs a Cursor hook that buffers events locally and uploads them in batches. Cursor telemetry requires the Scan Agent, and Willow must also enable it for your organization; ask Willow Support.

The Scan Agent leaves alone any agent that already exports to a collector other than Willow's.

Willow Guard Hooks​

Open Security > Guards > Setup & Coverage, select Set up Guard Hooks beside Claude Code, Cursor, or Codex, activate the plugin, choose its hooks, and deploy it through managed settings or your plugin marketplace. Hook events capture messages, user-invoked skills and commands, MCP prompts, and guard decisions. See Guard Hooks.

Send telemetry through your own collector​

To filter or enrich telemetry before Willow stores it, turn on OTLP proxy. Claude Code policies, Codex config, Cowork values, and the Scan Agent then point at your collector, which forwards to the endpoints above.

Troubleshooting​

  • Agent configured, but no data: check that the agent's switch is on under Collect Agent Telemetry. Willow returns 403 for agents that are off.
  • Data arrives without a user: the email the agent reports does not match a Willow user.
  • Prompt text is missing: turn on Log Content in Log Settings, and for Claude Code add Capture telemetry content to the policy.

Hook events and telemetry​

OpenTelemetry and Guard Hooks collect different kinds of events. Use the source cards to decide which data you need: native telemetry reports agent usage, while hooks capture lifecycle events and guard decisions.

Willow Guard Hooks data-source card showing Claude Code, Cursor, Codex, collected events, and Open Guards

On this page