Dashboards & Alerts
Overview
Dashboards and alerts are where the proxy's visibility surfaces. After deployment, Cerbera AI gives you a fleet-wide view of AI usage, the ability to drill into any user, application, provider, MCP server, tool, or session, and a stream of alerts produced by your rules. What each alert contains is governed by your privacy settings, so visibility never comes at the cost of employee trust.
Home Dashboard
The Home dashboard answers "what AI is happening across the organization?" at a glance:
| Tile | Description |
|---|---|
| Active users | Users with at least one AI interaction over the selected period |
| Total events | AI interactions observed over the selected period |
| Domains detected | Unique AI-related domains seen in traffic |
| Blocked events | Interactions a block rule stopped |
Alongside the tiles, the dashboard shows usage broken down by AI provider, a breakdown of the actions your rules took, and a table of the detection types feeding your alerts. From here you can filter and pivot into the detail views below.
The AI Registry's MCP Servers view has its own tiles (servers detected, active users, critical-risk and high-risk counts) scoped to MCP activity. See MCP Governance.
Drilling Down
Cerbera AI lets you drill into six kinds of entity, each with its own detail view showing usage, configuration, and every alert raised for it:
| Entity | What you see |
|---|---|
| User | The AI tools, providers, and MCP servers this person uses, and every alert raised for them |
| Application | How a given client application or process is used across the fleet |
| Provider | Usage of a specific AI provider (for example Claude or ChatGPT) across the fleet |
| MCP server | Clients, users, and tool calls for a specific MCP server |
| Tool | Usage of a specific tool exposed through MCP |
| Session | The events that make up a single AI interaction session |
This is how you answer questions like "who is using personal accounts on Claude Code?" or "which users connected to an unapproved MCP server?"
Alert Detection Types
Each alert carries a detection type that tells you what was found:
| Detection type | What it means |
|---|---|
| Secret exposure | A request contained a secret such as an API key or cloud credential. |
| PII exposure | A request contained personally identifiable information. |
| Personal license use | The account used is a personal, non-enterprise account. |
| Blocked tool use | A block rule matched and stopped a request. |
| MCP unverified | A connection to an MCP server Cerbera does not consider vetted. |
| Agent YOLO mode | An agent is running with approvals disabled. |
| Custom | A rule you wrote yourself. |
Each alert also has a status you can work through your queue with: open, accepted risk, false positive, or resolved.
What an Alert Contains
By default an alert records only that a rule matched, for which user, at what time. Whether the request body is attached depends on your privacy settings: it requires both an organization-wide logging setting and a per-rule setting to be on, and reading it afterward requires an admin to open a time-boxed, audited data request naming that specific person.
AI Usage Analytics
Beyond individual alerts, Cerbera AI can show aggregate usage: which classes of tool are used and in what proportion. This is deliberately sensitive territory. The goal is security insight, not monitoring individuals, so analytics respect the same privacy framework and the boundaries you set with your works council. Token figures, where shown, are rough fleet-level orders of magnitude (see Privacy).
Export
Every alert and rule match is available in OpenTelemetry format, so dashboards do not have to be the only place you consume this data. Stream alerts into your SIEM and existing workflows. See Openness & Interoperability.