Traffic Monitor
The Traffic Monitor is your primary operational view. It shows every LLM request in real time with shield verdicts, scores, and metadata.
What You See
- Shield Status — current mode (OBSERVE or BLOCK), read-only
- Session Watcher — status of the background log scanner (RUNNING/STOPPED, files watched, messages scanned)
- Traffic table — every request with time, source, model, provider, verdict, score, latency, tokens, HTTP status
- Filters — filter by source, model, provider, verdict, or minimum score
The table auto-refreshes every 5 seconds.
Traffic Columns
| Column | Meaning |
|---|---|
| TIME | When the request was processed |
| SOURCE | Where traffic came from: litellm (live), session-watcher (retroactive), break-glass (bypassed) |
| MODEL | Which AI model was requested |
| PROVIDER | Which backend served the request |
| VERDICT | Shield decision — ALLOW (green), REVIEW (yellow), BLOCK (red), BYPASSED (grey) |
| SCORE | Threat score 0-100 |
| LATENCY | Request duration in milliseconds |
| TOKENS | Total tokens used (input + output) |
| STATUS | HTTP status code (200 = success, 403 = blocked) |
Filtering Strategy
- Sort by SCORE descending to find the most suspicious requests
- Filter by VERDICT = BLOCK to see what is being caught
- Filter by SOURCE = session-watcher to see historical analysis
- Combine MODEL + VERDICT for incident investigation