Skip to main content
This document details the steps to confirm the Origin Observability Agent is installed, healthy, and capturing AI activity on macOS and Windows endpoints.

​
Contents

  1. UI and Diagnostic Report
  2. Verify Services and Processes
  3. Generate Test Activity
  4. Verify activity in the Origin Platform

​
1. UI and Diagnostic Report

The Origin Agent runs a small UI accessible from the system tray (Windows) or menu bar (macOS). The icon color is the fastest health check: Click the icon to open the menu. From here:
  • Diagnostic Report — runs a full self-test (registration, mTLS credentials, backend reachability, entitlements). Every line should read OK.
  • Open Log Folder — opens the runtime log directory:
    • Windows: C:\ProgramData\Origin\Agent\Logs\
    • macOS: /Library/Origin/logs/
If the icon is green and the Diagnostic Report comes back clean, the agent is healthy locally.

​
2. Verify Services and Processes

Both the Origin Agent and the Origin Watchdog must be running. The watchdog starts at boot and brings up the agent.

​
Windows (elevated PowerShell)

Both should report Running.

​
macOS

Two entries should return: com.origin.watchdog and com.origin.agent, each with a non-zero PID.

​
Cross-check in the Origin Platform

Sign in to the Origin Platform, open the Registered Endpoints view, and confirm your endpoint shows a recent “Snapshot Time”. If the endpoint is present here, it has registered successfully with the Origin Platform.

​
3. Generate Test Activity

Origin captures AI activity by three different methods, and each has to be tested separately — a passing test in one track says nothing about the others. Run the track that matches what you are verifying, or all three for a full check.
Embed a unique token in each test prompt — e.g. ORIGIN-VERIFY-<date> or a unique UUID — to make the prompts trivially searchable.

​
Sample prompts

A few industry-recognized prompts that exercise different capture archetypes. Use these in any of the tracks below:
  • Summarization — “ORIGIN-VERIFY-20260513 — summarize the NIST AI Risk Management Framework (AI RMF 1.0) in three bullets.”
  • Code generation — “ORIGIN-VERIFY-20260513 — write a Python function that validates an IPv4 CIDR string.”
  • Rewrite / tone shift — “ORIGIN-VERIFY-20260513 — rewrite this for a non-technical executive: [paste a short paragraph].”
  • Open Q&A — “ORIGIN-VERIFY-20260513 — list the OWASP Top 10 for LLM Applications.”
  • Data analysis — “ORIGIN-VERIFY-20260513 — given this CSV: [paste 5–10 rows], identify outliers and explain your reasoning.”

​
3.1 Agent capture — OpenTelemetry and application hooks

These applications are captured locally by the agent on the endpoint. No tenant-level integration is involved, so this is the only track that proves the install you just performed is working. Pick one or two of the following that are available on the verified endpoint:
  1. Open Claude Code — the CLI or the desktop app — on the verified endpoint.
  2. Send a verification prompt from the list above.
  3. Send a follow-up to generate a multi-turn session.
Track 3.1 is the one that validates this endpoint. Tracks 3.2 and 3.3 read from the provider’s cloud, so they report activity tenant-wide — including from devices with no agent installed — and a pass there does not mean the local agent is capturing.

​
3.2 Anthropic API integration — Claude chat

Claude chat activity is not captured on the endpoint. It is pulled from Anthropic’s Compliance API and covers both surfaces:
  1. Browser — sign in to claude.ai, send a verification prompt, then send two or three follow-ups to populate a meaningful session.
  2. Claude Desktop Chat — open the Claude desktop app, use the Chat surface, and send a verification prompt.
This track only produces results once the Compliance Access Key is configured under Admin → Data Sources. If it isn’t, no claude.ai or Claude Desktop Chat activity will appear regardless of how many prompts you send. See Claude Enterprise.

​
3.3 Microsoft 365 Copilot

Copilot activity is read from Microsoft’s own cloud APIs, not from the endpoint. Exercise one or more of the surfaces:
  1. Office applications — open Word, Excel, or PowerPoint, click the Copilot icon in the ribbon, send a verification prompt, then send a follow-up.
  2. Copilot on the web — browse to copilot.microsoft.com, sign in, send a verification prompt, and send a follow-up in the same conversation.
  3. Teams and Outlook — use the Copilot pane in either application and send a verification prompt.
This track requires the Entra ID directory integration to be connected, Capture Copilot activity enabled for that directory, and the readiness check passing. See Microsoft 365 Copilot.

​
4. Verify activity in the Origin Platform

Allow 1–2 minutes for events to propagate to the Platform, then:
  1. Open the Origin Platform.
  2. Locate the endpoint in All Endpoints view (this is the default landing page) and click it.
  3. Confirm the endpoint’s activity bar at the top of the page now shows recent prompt activity — colored ticks indicating prompts captured within the test window.
  4. In the Resource Overview graph, confirm the applications you exercised appear as nodes:
    • Track 3.1 — Claude Code, Claude Cowork, ChatGPT, or Codex, depending on what you ran.
    • Track 3.2 — Claude.
    • Track 3.3 — M365 Copilot, and often ChatGPT as well (M365 Copilot’s underlying model surface frequently appears under this label).
Activity from tracks 3.2 and 3.3 is sourced from the provider’s cloud rather than the agent, so look for it across the tenant rather than expecting it on the endpoint you just verified.
If the activity bar is empty after a few minutes, re-run the Diagnostic Report from the tray icon and check that every line reads OK, then consult the agent runtime logs. For the full matrix of which applications are captured by which method, see AI Provider Support.