Coverage Matrix

The Coverage Matrix answers "Where this workspace is blind, and how blind". It is the page to read before you trust a quiet Alerts list. It is under Collection, beside Connectors.

Who can do it

Without policies:write the Service categories tab draws no controls.

The four tabs

The page has four tabs. Open the one you need: a tab you do not open is not loaded.

Network

The Network tab lists the AI services the agent can recognise, and what each capture strategy can see of them.

Coverage at a glance has four tiles:

The four attribution levels mean:

Under the tiles, the page says where it is blind when it is:

• "N services are a name on a list." "No hostname could be established for them, so they match nothing, block nothing, and attribute nothing. Recorded rather than hidden."
• "N services live only in mobile apps." "Native iOS and Android traffic is invisible to the extension and the desktop agent alike. No strategy closes this."
• "No live machine runs ..." with the idle strategies named. "Every cell in those columns is capability, not coverage: what the platform could see if a machine were enrolled to look."
• "Nothing is enrolled yet." "Every figure above is platform capability. Coverage starts when the first machine enrols on a strategy."

The service list searches by "service, vendor, ID or host" and filters by depth (Content, Metadata, Unreachable), by catalogue (In the catalog, Uncatalogued) and by use (Observed, Not observed). Uncatalogued hosts are ones your fleet reached that the catalogue does not know. If usage cannot be read, the page says "This fleet's usage could not be read, so uncatalogued hosts cannot be listed."

Below the services, the Connections block lists each connection in this workspace and how much its credential can read, such as "N of M record kinds readable", and "Last sync ..." or "Never synced". With none, it reads "No connections yet. Connect a platform under Collection › Connectors and what its credential can read appears here."

Host

The Host tab is the same question asked of files on machines. Host coverage at a glance has five tiles:

A type with no scanner shows No scanner. A type nothing on your fleet carries shows Not observed. The list searches by "type, category, or tool".

When no agent in this workspace has reported a catalogue yet, the tab says so: "Showing this release's built-in catalogue; no agent in this workspace has reported one yet." or "Showing the newest catalogue reported by agents in other workspaces; none in this workspace has reported yet."

Engines

The Engines tab says, for each kind of thing a policy can look for, whether an engine is running in this workspace.

Each row ends in a status: Running, No verdict, "Switched off in this workspace." or "Not in this build's registry." Harmful content reads "An engine exists in the tree and is deliberately not registered in this build." Artifact scanning reads "Declared with no runner, so it collects nothing today." If the registry cannot load, the tab reads "Could not load the engine registry, so nothing here can be claimed." See Engines.

Service categories

A service category is a named list of AI services that a Network policy can name in a Service or Host filter as $slug. Oxelone maintains some of them. Your workspace can add its own.

Each category shows its name, an Oxelone or This workspace badge, its description, and counts such as "N services", "N seen here" and "N policies". Open one to see its services, the patterns each matches, and Observed where your fleet has used it.

To manage categories you need policies:write:

1. Open Collection › Coverage Matrix and choose the Service categories tab.
2. Choose New category. Give it a Name (the placeholder is "Research tools"), a Description ("AI tools the research team uses"), and choose its Services, or type a site such as chat.example.com.
3. To change a category, use its menu: Edit… or Delete…. Add services adds to a list; Remove takes out only what your workspace added.

The list searches by "category or service". With none, the tab reads "This workspace has no service categories." With no match it reads "Nothing matches this search."

Every change reaches machines on their next heartbeat.

When it goes wrong

Other read failures show as a red note at the top of the tab that failed.

With the API

Not available with an API key. The Coverage Matrix reads the console's own routes.