Skip to content

AI Metrics

Note

This is an enterprise-level feature of Security Onion. Contact Security Onion Solutions, LLC via our website at https://securityonion.com/pro for more information about purchasing a Security Onion Pro license to enable this feature.

AI Metrics gives administrators complete visibility into LLM usage, token consumption, and credit expenditures across the entire grid.

This screen is located under the Administration menu on the left side of the Security Onion Console and requires the superuser role.

Controls and Navigation

The AI Metrics toolbar provides precision filtering and display settings:

  • Breadcrumb Navigation: Shows the current inspection path (e.g., Users > Sessions > Messages). Clicking any breadcrumb segment immediately navigates back to that level.
  • Time Range Controls:
    • Relative Time: Specify a numeric duration combined with a unit of time (Seconds, Minutes, Hours, Days, Weeks, or Months). Clicking the history/clock icon switches to absolute mode, and the calendar icon switches back.
    • Absolute Date Range: Select explicit start and end dates and times using the calendar selector dropdown.
  • Refresh Button: Manually reloads metrics data for the active time window.
  • Options Dialog (Gear Icon):
    • Auto-Refresh Interval: Configure automatic polling intervals (from Never up to 24 hours).
    • Timezone: Select the timezone used to display times. Settings are preserved in the browser.
  • Expand / Collapse Graphs: A toggle button on the Graph Metrics panel allows collapsing charts to maximize table workspace.

Users View

The top-level view aggregates AI usage across all accounts on the grid during the selected time period.

Graph Metrics

Three interactive pie charts provide a visual breakdown of resource utilization:

  • Total Credits: Visualizes which users have consumed the largest share of credit budgets.
  • Total Sessions: Shows distribution of conversation sessions initiated by each user.
  • Total Messages: Displays message volume by model.

Hovering over any pie chart slice displays its exact value.

Table Metrics

The users table details individual account utilization:

  • Email Address: The user account email address.
  • Total Input Tokens: Cumulative count of prompt tokens sent to LLMs.
  • Total Output Tokens: Cumulative count of completion tokens generated by LLMs.
  • Total Credits: Total AI credits billed for the user's queries.
  • Credit Usage: The percentage of overall grid credit consumption consumed by this user.
  • Total Sessions: Number of distinct conversation sessions created.
  • Total Messages: Number of individual prompt and response messages.
  • Filter Results: Filter the table in real time by any column.
  • Actions: Click the binoculars icon to open that user's sessions list.

Sessions View

Clicking the binoculars icon on a user row drills into all conversation sessions associated with that account during the selected time period.

Session Visualizations

  • Credits Timeline: A line chart plotting each session's total credits at the time the session was created, highlighting periods of heavy interaction or intensive multi-step agent investigations.
  • Messages Pie Chart: Displays the user's message volume by model.

Sessions Data Table

The sessions table lists individual conversations:

  • Title: The title of the session, automatically generated from the initial query or manually set by the user.
  • Create Time: Timestamp when the conversation began.
  • Duration: Total elapsed time from the first turn to the final response.
  • Total Input Tokens and Total Output Tokens: Tokens consumed across the entire conversation.
  • Total Credits: AI credits consumed by the session.
  • Credits Per Minute: The rate of credit consumption during the conversation, helping identify fast-paced automated queries or intensive reasoning workloads.
  • Total Messages: Number of individual message turns in the session.
  • Actions:
    • Binoculars Icon: Drill into the conversation transcript to inspect individual turns.
    • Open Chat Session Icon: Opens the session directly in the Onion AI chat window (available when viewing your own sessions).

Note

Even if a user deletes a chat session in the Onion AI interface, that session remains fully preserved in AI Metrics. Retaining deleted sessions ensures administrators maintain a complete audit trail for compliance, security investigations, and credit accountability.

Messages View

Clicking the binoculars icon on a session row opens the complete, chronological message transcript.

Messages Data Table

The table details each turn of the conversation:

  • Role: Identifies whether the message was submitted by the user or generated by the assistant.
  • Message: A snippet of the message content.
  • Create Time: Timestamp when the message was sent or received.
  • Input Tokens and Output Tokens: Specific token counts attributed to this turn.
  • Credits: Credits charged for the turn.
  • Model: The specific model that processed the prompt and generated the response.

Inspecting Message Content

Clicking the expand arrow on any message row displays the full, rendered message:

  • Assistant Responses: Rendered with full Markdown formatting and diagrams (such as Mermaid flowcharts or sequence diagrams).
  • User Prompts: Displayed in full text.
  • Tool Invocations: Displays the parameters and return values of any tools invoked during that conversation turn.