Live activity
What Live activity shows for each interaction, and how to pause the stream
Live activity shows a live stream of every interaction passing through your Sentinel gateways — as it happens. Find it in the SUPERWISE® app under Observability → Live activity.
Each event appears the moment a gateway processes it, so you can watch traffic flow, spot policy interventions immediately, and confirm a newly deployed gateway is live.
Live activity shows metadata only — timing, routing, policy outcomes, token counts, and token-optimization savings. Your prompts and model responses are never sent to SUPERWISE®, so they never appear here. The token figures are counts, not content. See Data privacy.
What telemetry does each interaction report?
This is the complete set of metadata a gateway sends to SUPERWISE® for an interaction — the same data that feeds the Operational dashboard and the FinOps dashboard. Nothing else about the request leaves your environment: no prompt text, no response text, no system instructions, and none of the values a guardrail replaced.
| Field | What it holds |
|---|---|
| Time | When the gateway processed the request. |
| Sentinel | The gateway that handled it. |
| Provider & route | The upstream provider — OpenAI, Anthropic, Gemini, or a custom provider — and the route called. |
| Model | The model the request asked for. |
| Outcome | Passed, Remediated, Blocked, or Flagged. |
| Policy breakdown | Which guardrails ran, in which direction, each one's latency, and whether it triggered — never the matched value. |
| Latency | Total (end to end, including the upstream model call), policy (Sentinel's checks alone), and LLM (the upstream call). |
| Token counts | Prompt, completion, reasoning, and cache read/write tokens. |
| Token-optimization savings | For Headroom and Caveman, whichever ran: whether it was applied, the tokens before, after, and saved, the estimated saving, and the step's added latency. Headroom also reports the compression method(s) it used and the saving from each; Caveman also reports its intensity level. |
Stream and details
The stream shows the key columns at a glance — Time, Sentinel, Provider, Model, Outcome, Total latency, and Policy latency. Select any row to open its details, where the rest of the fields above appear, grouped into three sections:
- Record — timestamp, Sentinel, provider, model, and route; tokens saved and estimated saving for the request; and the total / policy / LLM latency split.
- Policy breakdown — each guardrail that ran, its direction and latency, and whether it triggered.
- Token optimization — a section each for Headroom and Caveman, marked Activated or Not activated. When active, Headroom compression shows raw prompt tokens, compressed tokens, tokens saved, ratio, the compression strategy used, and its added latency; Caveman shows output tokens, the estimated baseline (what the model would have produced without it), tokens saved, and the intensity level.
Caveman savings are estimated — it shortens generation rather than rewriting a prompt — which is why its figures are labelled as estimates.
Who, how long, and where can it go?
- Who: each event identifies the Sentinel that handled it, meaning the protected computer or the gateway, by the name it was given. It does not identify the person using it.
- How long: activity is kept for one year while your account is active.
- Where: you can view and report on it in the SUPERWISE app today. Export to a SIEM is on the roadmap.
Live controls
- Live / Paused — toggle the stream. Pause to inspect what's on screen without new events pushing it down; resume to pick the stream back up.
- Clear — empty the current view.
Requests sent to a gateway's diagnostic /test route are never recorded, so they don't appear in Live activity.
Get Sentinel: Sentinel on superwise.ai.
See also
- Operational dashboard: fleet health, security value, and latency.
- FinOps dashboard: token consumption.
- Data privacy: why prompts never appear here.
Updated 4 days ago