Events
The Events page lists every prompt and file that Sanitized AI flagged, one row per event. Admins see the whole organization. Managers see the people who report to them.
What’s in an event
The following table describes each column.
| Column | What it shows |
|---|---|
| Time | When it happened. |
| User and Email | Who it was. |
| Ai Website | The AI tool the prompt or file was headed to. |
| Channel | A typed Prompt, or a file, such as PDF or DOCX. |
| Flagged Guardrails | The guardrails that caught something. |
| Size | How many different sensitive values the prompt or file held, as a range, such as 50–199 values. See Size. |
| Guardrail Category | The category of those guardrails. |
| Outcome | What the person did next. See Outcomes. |
| Severity | From Low to Critical. |
An event doesn’t contain the text of the prompt. For a file, it includes the
file’s name, or only its type, such as •••.docx, if your organization masks
file names. See
File names in events.
Size
Size counts each different value once, across all the guardrails that fired: the same email pasted twice counts once. Names, places and IP addresses aren’t counted, because ordinary documents list many of them. Only the range is kept, never the values or the exact number.
A large size usually means a list was pasted or uploaded, such as a customer export. Events recorded before sizes were, or that matched only names, places or IP addresses, show –.
A lock next to the size means the event was blocked because of its size: your organization treats a list that long as a data export, so a guardrail that would only have warned blocked it instead. The person saw why in the warning.
Outcomes
- Flag Sanitized: the person replaced the sensitive data and sent the result.
- Flag Re-edited: the person changed the prompt themselves.
- Flag Ignored: the person closed the warning, or the tab, without sending.
- Flag Overridden: the person clicked Send Anyway.
- Flagged False Positive: the person reported the flag as wrong. See Review false-positive reports.
- Sent Unscanned: the person sent a file that couldn’t be checked, for example because it was password-protected, too large, or of a type that can’t be read. No guardrail flagged it, because its contents weren’t available. For why files can’t be checked, see File uploads.
- Monitored: the event was recorded without showing a warning.
To see this list in the dashboard, click the ? icon next to the Outcome column header.
Summary cards
The cards at the top of the page summarize the time range you choose (last 24 hours, 7 days, 30 days, or all time):
- Total Flags Triggered
- Flags Ignored
- Risk Prevented: flags that ended in a sanitized or re-edited prompt.
- High-Risk Actions: flags that people overrode.
- Flagged False Positives
- Top Triggered Guardrails
- Overrides: the share of flags people sent anyway, and the guardrails overridden most often.
The Overrides card is your best tuning signal. A guardrail near the top is one people routinely work around. Either it fires on data that isn’t sensitive, and should be fixed, or the data genuinely needs to be sent, and an exception fits better.
To leave out flags that an admin confirmed as false positives, select Exclude confirmed false positives.
Filter the list
- Choose how many Rows to show, a Start date and End date, and a Department.
- Click Apply filters.
The Search, Outcome, Category, Flagged Guardrail, and Size filters under the table narrow the rows already on the page. Size keeps events with at least 10, 50 or 200 different values.
Events that were recorded without a warning are kept out of the list by default. To see only those, turn on Monitor only.
Export events
- Load the events you want, using the filters.
- Click Export.
- Optional: narrow the list further, and choose the columns.
- Choose CSV or Excel, and then click Export.
The export includes only the events that are loaded on the page. To export a longer period, show more rows or narrow the dates, and export in several parts.
Admins can also pull events into another system automatically. In the export dialog, choose API for instructions. It needs a data export API key, which you create in My Organization > Data & privacy. The command uses the same filters as the page, including Department and Monitor only, and returns every matching event, not only the ones loaded on the page.
False-positive reports
Admins see a False Positives button at the top of the page, with a count of new reports. See Review false-positive reports.