Getting Started with SenseOn Reveal: Unlocking the Power of Your Security Data
SenseOn Reveal integrates seamlessly into your existing SenseOn platform, providing intuitive tools for data exploration and analysis.
Filter your dashboard by: IT Hygiene / Threat Hunting / All
Finding and opening dashboards
Opening Reveal takes you to a landing page that lists the dashboards available to you, rather than opening a dashboard straight away. The landing page has:
- A Search dashboards box, to find a dashboard by name.
- Category chips beneath the search box, to narrow the list to a category.
- Your dashboards grouped into sections and shown as tiles, in this order: Favourites (when you have any), Governance & compliance (shown only when a governance dashboard is available to your tenant), Security insights, and Custom dashboards (the dashboards your organisation has created, shown only when you have any).
Select a tile to open that dashboard.
Favourites
Each dashboard tile carries a star. Select the star to add the dashboard to your Favourites, or select it again to remove it. Your favourited dashboards appear in the Favourites section, at the top of both the landing page and the navigation menu.
Opening a dashboard from any page
Hovering the Reveal item in the main navigation opens a menu with the same list of dashboards, along with the same search box and category chips, so you can move to a dashboard from any page without returning to the landing page first.
Returning to the landing page
When a dashboard is open, its title bar shows a Reveal › Dashboard breadcrumb. Select Reveal in the breadcrumb to return to the landing page.
Following a link to a dashboard you cannot open (one that is hidden, unknown, or has been removed) also returns you to the landing page, rather than opening a different dashboard.
Creating and editing custom dashboards
Alongside the dashboards SenseOn provides, your organisation can build its own. Custom dashboards are available to everyone in your organisation and appear in their own Custom dashboards section on the landing page and in the Reveal menu, after the sections holding the dashboards SenseOn ships. The section is hidden until your organisation has created a dashboard.
Who can do this: Creating, editing and deleting custom dashboards is available to the Admin and Manager roles. Analysts can open and read custom dashboards but cannot create or change them. The editor's JSON panel and generated-query view remain Root-only. See User Management for what each role can do.
Creating a dashboard
- Open Reveal to reach the landing page.
- Select Create new dashboard. An empty editor opens.
- Add a widget, then choose the data source and the measure it should show. A preview updates as you build the widget; select Apply to place it on the canvas.
- Repeat to add as many widgets as you need, arranging them on the canvas.
- Select Save. In the save dialog, give the dashboard a name and an optional description, then assign it one or more Categories — pick from the categories already in use or type a new one and press Enter, up to 10 categories of up to 64 characters each. Categories determine which category chips the dashboard appears under on the landing page and in the Reveal menu.
Your saved dashboard then appears in the Custom dashboards section on the landing page and in the Reveal menu.
Editing or deleting a dashboard
Edit and Delete are offered only on the dashboards your organisation created, not on the ones SenseOn ships. A custom dashboard is marked as user-created in its title bar.
- From the landing page or the Reveal menu, open a custom dashboard tile's menu to Edit or Delete it.
- With a custom dashboard open, use Edit or Delete in its title bar.
Editing reopens the dashboard in the same editor, where you can add, change or remove widgets and save your changes.
Taking a value from a JSON column
When you build a widget, you can add a calculated field, a value Reveal works out from the source's data and then charts like any other field. One of these is the JSON value recipe, which reads a single value out of a column that holds a whole JSON object.
A few data sources carry their original payload as JSON in one column:
- The six Logs View sources have an Unmapped column.
- MS Directory Audit Logs and MS Graph Alerts have a Raw Data column.
- GCP Security Findings has a Raw Alert column.
These columns are hidden from the ordinary field pickers, because a whole JSON object is no use as a dimension on its own. The JSON value recipe is the only thing that reads them.
GCP Security Findings is itself a new source in the Dashboard Lab, available on tenants with a Google Cloud integration. It carries findings from Google Cloud Security Command Center, covering threats, vulnerabilities and misconfigurations in your Google Cloud resources, with each finding's Category, Severity, State and the resource it concerns. Each row is one update to a finding, so count unique Finding Name values to count findings, or chart them over time to see how findings change.
To add a JSON value field:
- While building a widget, select Add calculated field, then JSON value.
- Choose the Column to read from. If the source draws on more than one data source, choose a Data source as well, as Reveal samples the keys from one data source at a time.
- Pick the key to read. Reveal samples recent rows and shows the column's keys as a tree. Each key shows what it holds (text, a number, an object, or a list) and the share of sampled rows that contain it. Open an object to reach the keys nested inside it, or use the search box to find a key by name.
- Choose how the field is used:
- Group the chart by it uses the value as a dimension. Under Treat as, choose whether to read it as Text, a Number or a Date and time. Where the key holds a list, you can take its first item, its last item, or the number of items. You can also choose what a row that does not have the key counts as: no value, or empty text or 0.
- Count, sum or average it uses the value as a measure. Choose an Aggregate: count, unique count, sum, average, minimum or maximum.
- Select Add field to place it on the widget, where you can put it on an axis or use it as the measure, like any other field.
A short summary beneath the form describes the field, for example "Reads evidence › verdict from Raw Data as text."
Dashboards (a few examples)
Case Activity Overview
This section provides a summary of cases which have been actioned across your estate. Useful for understanding:
- Work done by the SOC
- The threat profile your company faces
- Any pending actions which require your attention
Available widgets in Case Activity Overview:
- High priority cases over time
-
Monthly escalated cases
-
Risky Users
- MITRE Tactics
- Common processes found within high priority cases
- Total Count Case by Case Severity
- Number of high priority cases by status from the last 30 days
- Threat status of resolved high priority cases over past 30 days
- Data transfer within high priority cases
- Number of high priority cases by device type
Device and User Insights
Gain comprehensive visibility into your device ecosystem and user behaviours with detailed risk metrics and anomaly detection. This tab highlights:
- Health status and compliance levels across your estate
- User activity patterns with flagged high-risk behaviours
- Potential security vulnerabilities requiring immediate attention
Available widgets in Device and User Insights:
- Operating Systems
- Operating systems across the estate past week
-
Least commonly installed program versions
-
Least common startup items
-
NTLM Failed Authentication Attempts
- Failed Kerberos Authentication Attempts
- Escalated cases by device user
- File Sharing Programs
- Vulnerable Potentially Unwanted Programs (PUPs) Installed
- VPN Applications
- Remote Access Tools
- Risky Users
- Files in Use Containing Passwords
Data Transfer Overview
Visualise and analyse all data movement within and beyond your network perimeter. This intelligence helps you:
- Identify unusual data transfer volumes or destinations in real time
- Monitor sensitive data flows across geographic boundaries
- Detect potential data exfiltration attempts through pattern recognition
Available widgets in Data Transfer Overview:
- Total Daily Upload Volumes
-
Total Daily Download Volumes
-
Data Transfer by Country (Destination Host)
-
Devices downloading most data
- Devices sending the most data
- Users downloading most data
- Users sending the most data
- File Sharing Programs
AI Governance
The AI Governance dashboard shows AI application and service usage across your estate, by device and user. It is listed under Governance & compliance, the first section on the Reveal landing page, and appears under the IT Hygiene filter. It has four tabs: Overview, for AI usage seen on your devices and network, Accounts, for the seats your organisation holds with AI providers, Detection, for what content scanning finds in prompts sent to AI services, and Microsoft 365 Copilot, for how your organisation uses Microsoft 365 Copilot, taken from Microsoft's own audit log.
How SenseOn detects AI use
SenseOn identifies an AI application with three detection methods:
| Detection method | How it identifies an AI application | Platforms |
|---|---|---|
| Network traffic | The hostname the device connects to over an encrypted (TLS) connection. | All devices with the Universal Sensor |
| Running process | The name of the process running on the device. | All devices with the Universal Sensor |
| Installed app | The device's software inventory. | Windows and macOS only, as Linux devices do not report software inventory |
An AI application used only in a web browser has nothing installed on the device, so the Installed app method cannot see it. Network traffic still can.
Each usage widget on the Overview tab draws on one detection method, shown by an indicator in its header. Hover over the indicator to see the method and the AI applications it can currently identify. The figures in that widget only cover what its method can see. The AI applications detected by detection method widget covers all three methods, and the Accounts tab uses data from your AI providers rather than these methods.
Which AI applications are covered
The dashboard recognises AI applications from a list that SenseOn maintains and checks, rather than flagging anything that looks like AI. The AI applications detected by detection method widget shows the current list. Select it to expand a table with one row per application and a column for each detection method, where a tick means that method identifies the application. This widget shows SenseOn's detection coverage, not activity in your estate.
Keep these points in mind when reading the dashboard:
- Tools not on the list do not appear. An AI tool that SenseOn does not yet recognise is not counted, even if your devices use it. If you need a tool added, ask the SenseOn SOC through the Support Hub.
- New tools are not added retrospectively. Usage is matched to AI applications as each day's data is summarised. When SenseOn adds an application to the list, it appears from the day the update reaches your environment, and earlier activity is not shown.
- Usage history starts when the dashboard was enabled. The usage widgets cover the last 7 or 28 completed days, and only from the point the dashboard's data started being collected for your tenant.
For a one-off look further back, or at a tool that is not on the list, the SenseOn SOC can run a hunt across your raw network and DNS records in Hunt Lab.
Why the figures differ from Microsoft Defender
If you also use Microsoft Defender for Cloud Apps, it will usually report more AI applications than SenseOn. The two products count differently:
- Defender matches activity against Microsoft's own catalogue of several thousand cloud applications. SenseOn uses its shorter, curated list.
- Defender can count a visit to a web page that loads an embedded AI feature, such as a chat or text-to-speech widget, as use of an AI tool. SenseOn counts connections to AI services and AI applications running or installed on your devices.
For the widely used AI applications, the two products should broadly agree. Most of the gap comes from tools outside SenseOn's list and from embedded web widgets.
Overview tab
| Widget | What it shows | Detection method |
|---|---|---|
| AI applications detected by detection method | The AI applications SenseOn can detect, and which methods identify each one. | All three |
| AI services reached (7d) | AI services your devices reached over encrypted connections, ranked by how many devices reached each one. Because this comes from network traffic, it includes services your organisation has no account with. | Network traffic |
| Top AI users (7d) | Users ranked by the number of connections their devices made to AI services. Usernames are local operating system accounts, so they may not match the person's cloud or corporate identity. | Network traffic |
| Deliberate versus background AI use (7d) | Devices reaching AI services each day, split by whether the traffic came from a dedicated AI application, a browser, or AI features built into other applications such as Microsoft Office. A device can appear on more than one line, so the lines should not be added together. | Network traffic |
| AI applications in use (28d) | AI applications that ran on your devices, ranked by how many devices ran them. Each device is counted once per application. | Running process |
| Code pushed by AI applications (28d) | How many times AI applications ran git push from the command line. This counts attempts rather than successful pushes, and excludes editors and graphical clients that do not call git directly. |
Running process |
| AI applications installed (28d) | AI applications found in your devices' software inventory, ranked by how many devices they are installed on. | Installed app |
| Data uploaded per AI service (28d) | Data sent to each AI service, split by whether it came from a browser or an installed application. Data is counted when a connection closes. | Network traffic |
SenseOn can only identify which application generated AI traffic on Windows devices. Traffic it cannot attribute is shown as Unattributed rather than hidden.
Accounts tab
The Accounts tab reports the seats your organisation holds with connected AI providers, such as Anthropic and OpenAI. A seat is one account a person holds with one provider, so a person with accounts at two providers counts as two seats. Use it to find unused seats you could reclaim and to review who holds admin access. It is an IT hygiene report, not a source of cases or detections.
The tiles are only populated for AI providers you have connected. If you have no Anthropic or OpenAI integration, the tab shows Connect an AI provider to see accounts in place of its tiles, with a Set up an integration button that opens Integrations. An integration counts whatever its status, so a paused integration still shows the tiles. With a provider connected, Dormant seats (28d) can still be empty if that provider does not share usage data.
- Seats by provider (28d) lists every seat on your enterprise account with each provider, whether or not anyone used it in the last 28 completed days. Personal accounts are not counted. Its columns are Seats held, Active (28d), Dormant, Never used, Hold admin and What can we see.
- Dormant seats (28d) lists seats with no activity in the last 28 completed days, longest unused first. One person can appear more than once if they hold seats with more than one provider.
- Seats with admin roles lists seats holding an administrative role with each provider. Role names are each provider's own wording. These are admin roles at the AI provider, not SenseOn's own Admin role.
Providers share different data with SenseOn. Anthropic shares what people actually do in the product. OpenAI only reports when a seat is created, changed or removed, never whether it is used. For that reason Active (28d), Dormant and Never used are only filled in for providers that share usage, and only those providers appear in Dormant seats (28d). The What can we see column states what each provider shares. The Total row only sums Seats held, the one figure every provider reports the same way.
Detection tab
The Detection tab reports what content scanning finds in prompts your users send to AI services. In this release, content scanning looks for secrets and credentials, such as passwords and API keys pasted into a prompt. Every finding names the rule that fired and where it fired. The dashboard never shows the prompt text itself.
The tab needs an Anthropic (Claude) Enterprise or Microsoft 365 Copilot integration with message scanning turned on in the integration's settings. Without one, the tab shows Turn on content scanning to see what it finds in place of its tiles, with a Set up an integration button that opens Integrations.
Counts begin on the day content scanning is enabled for your organisation, and earlier activity is not shown. A short history means scanning is new, not that AI use is. A tile reading Nothing to report means content scanning raised no detection in that window.
| Widget | What it shows |
|---|---|
| Total AI findings (28d) | Every finding content scanning recorded in the last 28 days, with the change over the most recent 14 days compared with the 14 days before. |
| AI findings per day (28d) | Findings recorded each day over the last 28 days. |
| Findings by type (28d) | How the findings split by type. In this release every type comes from the secrets and credentials rules. |
| Users with the most findings (28d) | The users behind the most findings. Users are identified by the email address on the account signed in to the AI service, so one person can appear under more than one address. |
| Latest AI cases (28d) | Cases content scanning raised, newest first, with the detection type that fired and the user behind it. Select a case ID to open the case. |
Microsoft 365 Copilot tab
The Microsoft 365 Copilot tab shows how your organisation uses Microsoft 365 Copilot: who uses it, in which apps and how often. Unlike the Overview tab, which draws on SenseOn's own detection methods, this tab reads Microsoft's own audit log through an Office 365 Management Activity integration.
Every tile except Paid seats covers the last 28 completed days. Today is excluded, so the newest day shown is yesterday. Counts begin on the day SenseOn started receiving this data from Microsoft, and activity from before then is not shown. Agents, and apps that read people's Copilot conversations, are shown apart from people and are never added into their totals.
The headline row across the top shows:
- People using Copilot (28d) counts people who used Copilot at least once. Agents and apps are not counted. A small sparkline along the foot of the tile tracks daily active users.
- Interactions by people (28d) counts prompts people typed into Copilot, with the change over the most recent 14 completed days compared with the 14 before.
- Actions by agents (28d) counts actions taken by agents rather than people. These are not included in people's totals.
- Paid seats shows Copilot licences purchased and assigned, as a Purchased and an Assigned figure.
The tiles below the headline row are:
| Widget | What it shows |
|---|---|
| Copilot by app (28d) | Interactions by people in each Microsoft 365 app, ranked. Agents are left out. |
| Daily active Copilot users (28d) | People who used Copilot each day over the last 28 completed days. |
| Copilot interactions (28d) | Daily interactions, stacked by who made them: people, agents and Security Copilot. |
| Agent activity (28d) | Actions taken by agents rather than typed by a person: Copilot Studio agents, automation agents, scheduled prompts and Security Copilot. There is one row per agent kind, not one per agent. Microsoft records each action under the person the agent works for. Its columns are Agent, Operation, Actions and People acted for. |
| Top Copilot users (28d) | People with the most Copilot interactions, ranked. Agent actions are not counted. |
| Apps reading Copilot conversations (28d) | Applications that read people's Copilot conversations through Microsoft's export API, such as data security or archiving tools. Every reader is shown. Its columns are App, Reads, Messages read and People covered. |
Empty states
The tab needs an Office 365 Management Activity integration. Without one, the tab shows Connect Office 365 to see Copilot use in place of its tiles, with a Set up an integration button that opens Integrations.
The Paid seats tile has its own empty state: when no Microsoft licence rows have arrived in the last three days, it shows Connect Microsoft 365 Copilot to see paid seats, with a Set up the integration button that opens Integrations. The rest of the tab still shows its tiles.
Choosing a Microsoft 365 integration
When the tab is showing its tiles, its filter bar leads with an integration menu. It opens on All integrations and then lists each of your Office 365 Management Activity integrations by name. Choosing one narrows every Copilot usage tile on this tab to that integration. Paid seats is not narrowed by this choice, as its licence data comes from a separate source. The menu is hidden while the tab is showing its empty state.
If you move to another tab with an integration chosen, your choice shows there as a chip carrying the integration's name.
Producing an AI usage report
To report on AI use across your estate:
- Open Reveal and select AI Governance under Governance & compliance.
- Review the Overview tab. Top AI users (7d) and AI applications in use (28d) answer most "who is using what" questions.
- Use Download data as CSV on each widget you want to include. See Download widget data as CSV for what the file contains.
Remember that each Overview usage widget only covers the AI applications on SenseOn's list, over its own time window, and through its own detection method. State this alongside any figures you share.
1 data, 2 views
Two view options are available for each widget: chart or table view.
Changing a chart's aggregation, sort or time bucket
On a bar, column or line chart, an axis label whose axis has choices to offer becomes a button with a chevron. Select it to open a menu, with the option in force marked. Which menu you get depends on the axis:
- Aggregation, on the value axis, changes how the measure is summarised: Sum, Average, Minimum, Maximum, Count or Unique count. Only the aggregations that suit the measure are listed.
- Sort, on a category axis, orders the chart by its values: Ascending or Descending.
- Time bucket, on a time axis, changes the period each point covers: Hourly, Daily, Weekly or Monthly. A time axis offers this in place of a sort, because a time series is read in time order.
Choosing an option re-runs the widget with that change. It applies to your current view of the widget and is not saved to the dashboard. An axis label without a menu has no choice to offer for that axis.
Case titles when breaking down by case
When you break down a widget by case, Reveal shows each case's Case Title beside its Case ID, so you can tell the cases apart without opening each one.
- In chart view (bar, column, stacked column and pie), the case title labels the category, on the axis or the slice. Hovering a bar, column or slice shows its Case ID in the tooltip, beneath the title.
- In table view, a Case Title column sits directly after the Case ID column.
- The CSV download follows the table, so it carries both columns.
Selecting a case still acts on its Case ID, so drilling in, cross-filtering and View case in Experience are unchanged.
Paging through table rows
In table view, a widget pages through its rows rather than scrolling within the tile. When there is more than one page, a footer beneath the table reads Rows X to Y of N alongside a pagination control for moving between pages. A table that fits on a single page shows neither the row count nor a pagination control.
On a dashboard, each tile fits as many rows to a page as its height allows, so a taller tile shows more rows per page. Paging is display only: it changes which rows are on screen, not the underlying data, its sort order or any filters you have applied.
Exploring the Other slice on pie charts
Where a pie chart groups its smaller categories into a single Other slice, you can select that slice to expand it in place. The pie then shows the slices that Other grouped, and a breadcrumb row appears above the chart: All slices followed by Other (N slices). Select All slices, or the ✕ button beside it, to return to the full pie.
A long tail opens a level at a time. When an Other slice holds many slices of its own, expanding it shows the largest of them and rolls the rest into a fresh Other slice, which you can expand again. Each level adds a crumb to the breadcrumb row, for example All slices › Other (996 slices) › Other (994 slices). Select any earlier crumb to step back to that level.
If one of your own categories is itself named "Other", the breadcrumb instead reads Other (grouped) for the synthetic slice, to keep the two apart.
Pie charts only group measures that can be added together. A pie of a measure that does not sum across categories, such as a unique count, an average, a minimum or a maximum, shows its categories without an Other slice.
Expanding the Other slice is display only: it does not change the underlying query, the table view or the CSV export.
Paging through chart bars
In chart view, a bar or column chart pages through its bars, in the same way the table view pages through its rows, rather than dropping everything past a fixed limit. Each chart draws a set number of bars per page, and when there is more than one page, a footer beneath the chart reads Bars X to Y of N alongside the same pagination control the table view uses. A chart that fits on a single page shows no footer.
Every page is drawn on the same value axis, sized to the chart's largest bar, so a later page is directly comparable with the first. Paging is display only: it changes which bars are on screen, not the underlying data, its sort order or any filters you have applied, and the table view and CSV download still carry every row. Re-running the widget, for example after a drill or a cross-filter, returns to the first page.
Exploring the Other group on Sankey charts
A Sankey chart keeps its largest flows and groups the remaining smaller flows into a single Other node on each side, shown in grey, so the total volume drawn is unchanged. Hovering Other lists its largest grouped flows.
Select an Other node to expand the grouped flows in place. A breadcrumb row appears above the chart: All flows followed by Other (N flows). Select All flows, or the ✕ button beside it, to return to the full chart.
As with the pie chart's Other slice, expanding is display only: it does not change the underlying query, the table view or the CSV export.
When a chart shows only the first results
Each chart fetches up to a fixed maximum number of rows. When a pie, bar, column or Sankey chart's data comes back at that maximum, more rows may exist than were fetched, and a line appears beneath the description: Only the first N results are included. More exist.
This matters most where the chart groups a long tail: its Other slice, Other node or paged bars then account only for the rows that were fetched, not for everything beyond the limit. The table view and the CSV download read the same fetched rows, so they are bounded the same way. To concentrate on the rows you need, narrow the widget with a drill or a cross-filter.
A widget whose own definition already asks for a set number of results, such as a top 10 or bottom 10, is not flagged, because that cut is intended.
KPI tiles
A KPI tile shows a single headline figure. When the tile has a time series, it reads as the latest value with its period beside it, for example 184 in Sep 2026, above a small sparkline of the series along the foot of the tile.
Beneath the value, the change from the previous period reads as an arrow and percentage together with the period it is compared against, for example ↓ 13% vs Aug 2026 (212). The arrow and percentage are green when the change is good and red when it is bad, judged per tile: for most tiles a rise is good, but for a tile where lower is better a fall is the good direction. When the value is unchanged, the tile reads No change.
A KPI tile without a time series shows the value on its own, with no period, change or sparkline.
Download widget data as CSV
Alongside the chart and table view toggles, the controls for each widget include a Download data as CSV button (the download icon). Selecting it saves the current data for that widget as a CSV file.
The file contains every row the table view holds, not only the page currently on screen, in the same column order and using the column names the dashboard defines. Anything you have applied to the widget, such as drilling into a data point or a cross-filter, is reflected in the export, so a drilled widget downloads its drilled data. The file is named senseon_reveal_<widget-title>.csv, and a confirmation appears once the download starts.
Opening a case in Experience
Case Activity widgets such as Total Count Case by Case Severity count cases rather than listing them. Because a case's identifier is treated as an attribute, you can break a widget down by Case ID to turn a count into the individual cases behind it, then open any one of them.
To move from a case count to a single case:
- Select a data point on a Case Activity widget (for example a severity bar) to open its data point menu.
- Choose Break down, then select Case ID. The widget re-runs as a list of the case IDs that make up that data point.
- Select a Case ID value to open its data point menu, then choose View case in Experience.
View case in Experience opens that case in Experience, filtered to the selected case ID over all time so that an older case is not hidden by a fixed time window. The item appears only on a populated Case ID value, not on a count of cases, and not on an empty or Unknown value.