# AI monitoring

The AI Monitoring tab shows you which large language models (LLMs) are being called from your team's devices. The Device Protection agent detects outbound API calls to LLM providers and surfaces them here, giving you a clear picture of AI tool usage across your organization.

<figure><img src="/files/SCiq7gHb6xQocMsy1w2A" alt=""><figcaption></figcaption></figure>

## What the table shows

Go to [Device Protection and open the AI Monitoring tab](https://app.aikido.dev/endpoint-protection/ai-monitoring).

Each row represents a unique model that has been called from at least one device:

* **Model** - The specific model identifier (e.g. `claude-opus-4-7`, `gpt-5.4`)
* **Provider** - The company that provides the model (e.g. `anthropic`, `openai`)
* **Devices** - How many devices have made calls to this model
* **Last used** - When the most recent call to this model was detected

Use the **Search** bar to find a specific model or provider by name.

## Why this matters

Developers increasingly use AI coding assistants, chat interfaces, and custom integrations that call LLM APIs directly. Without visibility, it is hard to know which external AI services your team is sending data to, or whether those services are approved by your organization.

AI Monitoring gives security and IT teams a live inventory of AI model usage without requiring developers to self-report.

## What to look for

* **Unfamiliar models or providers** - A model you don't recognize may indicate an unapproved tool or a personal API key being used on a work device
* **High device counts on unexpected models** - Wide adoption of a model you haven't vetted is worth reviewing
* **Stale last-used times** - A model that was used briefly and then abandoned may indicate a one-off experiment worth understanding


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://help.aikido.dev/aikido-device-protection/using-aikido-endpoint/ai-monitoring.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.