Overview
The User Activity page centralizes up to 30 days of governed GenAI events. This covers activity across the workforce. It helps admins understand usage, assess risk, and investigate potential policy violations. It also helps export records for audit or analysis. Events reflect F5 Workforce AI Security's interception of GenAI traffic. They also include context such as user identity, intent, risk level, policy outcome, and request/response details when available.
Available actions and information
Review who used which GenAI services, when, and for what purpose
See risk levels and any violations associated with each request
Open detailed fly-outs for full request context and conversation content
Filter and search to isolate relevant activity
Export a CSV of the currently filtered events for offline analysis or sharing
Prerequisites and access
Administrative access to the Workforce AI Security admin interface
Identity configuration that maps events to named users (for example, the X‑Authenticated‑User header via SASE or user authentication)
User Activity event list details
Each row in the event list represents a single governed request.
User: Displays the user's name and email for every request. This identity is derived from the configured authentication method. For example, this could be a SASE header or user authentication. This ties investigations to a specific person.
Intent: Shows the purpose of the intercepted request as determined by Workforce AI Security’s intent classification. Intent helps admins understand what the workforce is using GenAI for. Examples include General, Marketing, and Product management. Intent also helps track adoption by use case.
Service: The destination GenAI service associated with the event. Examples include ChatGPT, Microsoft 365 Copilot, Claude, and Perplexity.
Risk Level: The assessed risk for the request (for example, Low, Medium). Risk reflects input and output analysis. It also reflects the presence of any policy detections.
Violations: Any violations identified by policy, when present. If none were detected, this field reads “none.”
Result: The action/outcome taken for the request. See Results glossary below for precise meanings.
Time: The timestamp of the event.
Actions: Quick actions to investigate the event:
Chat bubble icon: opens the Conversation History fly-out. This displays the user prompt and the service response if available.
Right‑pointing arrow: opens the User Event Details fly-out. This includes technical and policy details about the request.
Results glossary
INTERCEPT: The request was allowed to proceed unaltered through Workforce AI Security policy.
REDACT: Data was removed from the request due to Workforce AI Security policy. This happened before forwarding to the service.
LOGIN: The user authenticated with Workforce AI Security before reaching the GenAI service. This ensures access was allowed by policy. Conversation content may be available. This happens if a prompt occurred after login in the same session.
ACCESS: The user accessed a GenAI service. A prompt may or may not have occurred. When a prompt did occur, conversation content can be available.
PORTAL: The user was not allowed to access a specific GenAI service. The user was redirected to the URL set by the Service Block Action.
BLOCK: The request was blocked by Workforce AI Security policy. It was not forwarded to the destination service.
ERROR: The request could not be processed due to an error. For example, the cause could be a network, destination service, or policy evaluation failure. Review the event’s details and trace ID for troubleshooting.
Working with events
Filtering
At the top of the page, select Filters. This narrows the events displayed. Filters can be combined to focus an investigation. For example, an admin could combine filters to find all redactions for a specific team over the last week.
Common filter categories include: Date, Result, Violation, User, Risk Level, and Service.
After choosing one or more filters, apply them. This updates the event list. All other actions (search and export) operate on the filtered set.
Search
Use the search text box. Look for specific words in intercepted GenAI prompts. This helps quickly locate conversations that mention a product name, client, or sensitive topic.
Conversation History fly-out
Click the chat icon in the Actions column. This opens the Conversation History fly-out. When available, it shows the user’s prompt and the model/service response for that event. This allows point‑in‑time review of exactly what was sent and returned.
Note: Conversation visibility depends on policy configuration. It also depends on the specifics of each event. Conversation content may not be available. If so, the chat icon that opens the Conversation History fly-out greys out.
Permissions
Conversation History can be disabled for specific admins. Disable the permission named "View User Event Conversation History" within the Admin User's Permissions to prevent access.
Configuration steps:
In the admin console, go to Users & Groups > Admin Users.
Select the admin to update.
Click the Edit button and toggle off View User Event Conversation History in the Permissions section.
Save changes.
User Event Details fly-out
Click the right‑pointing arrow in the Actions column. This opens the User Event Details fly-out. This view provides deeper context for investigations, including:
User identity, service name, and classified intent
Policy review (PII entities, content controls, routing, and any violations)
Risk Assessment with input and output analysis
Request details such as type (browser/API), request domain, start/end time, duration, IP addresses, user agent, and the event’s trace ID
Exporting events
At the bottom of the page, click EXPORT. This downloads a CSV containing all events matching the current filters. This is ideal for sharing, ad‑hoc analysis in spreadsheets, or importing into other tools. For automated exports and long‑term retention, see the separate “Exporting User Activity Logs” guide.