Skip to main content
Activity Clustering automatically groups AI activity into semantically related clusters so you can see — at a glance — what your organization is actually using AI for. Clusters are named automatically based on the content of the prompts inside them, so you get human-readable labels like “Security Review” or “Rust Code” without any manual configuration. The Contrast matrix then maps those clusters against agents in a grid, making it easy to spot which agents are driving which types of activity across your fleet.

​
Left Panel — Filters

The left panel controls what data appears in the Contrast matrix. It shares the same controls as the Endpoint Explorer dashboard.
  • Date range picker — sets the time window for the activity being analyzed. Narrowing the range lets you focus on a specific incident window; widening it reveals longer-term usage trends.
  • Agents — displays all detected agents, each with an activity sparkline and a total request count for the selected period. Use Filter agents to search by name and Sort to reorder the list — for example, by Most active. Selecting an agent in this list filters the matrix to show only that agent’s activity.

​
Right Panel — Contrast Matrix

The right panel shows the Contrast view under the Organization context. The matrix has fully configurable axes: Every cell in the matrix represents the intersection of one agent and one cluster. The dot rendered in each cell encodes the relative activity level for that combination: Hover over any cell to inspect the detail for that specific agent-and-cluster combination, including the underlying request counts and any available prompt metadata.

​
Reading Column Headers

Cluster column headers are generated automatically from the prompts in each cluster. Because clusters can have long descriptive names, headers are truncated in the grid — for example, you might see “Rust Code In…” or “Security Review…”. Hover any column header to read the full cluster name.
Cluster names are derived from real prompt content, so the vocabulary reflects how your users are actually phrasing their requests. Names will evolve as new prompts are ingested and clusters are recomputed.
Use the Contrast matrix to identify which teams or tools are driving unusual AI activity patterns. If one agent shows a disproportionately large dot in a sensitive cluster — such as one related to security review or credential handling — that is a strong signal to investigate that agent’s recent trace logs in the Endpoint Explorer.