> For the complete documentation index, see [llms.txt](https://docs.veza.com/4yItIzMvkpAvMVFAamTf/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.veza.com/4yItIzMvkpAvMVFAamTf/features/activity-monitoring/activity-monitoring-overview.md).

# Activity Monitoring

Review dormant access and overprovisioning risk for AWS, Snowflake, Okta, and ServiceNow, one platform at a time.

{% hint style="info" %}
**Early Access:** The redesigned Activity Monitoring page is available on an Early Access basis. Contact your Veza account team to enable it.
{% endhint %}

**Activity Monitoring** gives security and IAM teams a per-platform overview of access risk, focused on two recurring problems:

* **Dormant access:** Access that has not been used within the [Activity Monitoring Timeframe](#key-definitions). The summary tiles count dormant users, and the Platform Metrics tiles count dormant roles, databases, applications, and other resources (for example, *Dormant Snowflake Databases* or *Dormant AWS IAM Roles*).
* **Overprovisioning:** Identities and roles that use only a small part of the access they are granted. See [Overprovisioned](#key-definitions).

Some platform tabs also include tiles for **non-human identities (NHIs)**, such as service accounts, that have dormant access to sensitive resources (for example, *Dormant Non-Human (NHI) Snowflake Users*).

Each platform is presented on its own tab. A tab combines high-level **summary tiles** (how many users are dormant, how many roles are overprovisioned, and so on) with a grid of **Platform Metrics**, which are focused queries that count specific risky patterns for that platform. Each count on the page opens the underlying assessment, which lists the identities or resources included in that count.

Use the page to prioritize least-privilege remediation one platform at a time, for example by revoking dormant Snowflake roles or reducing the access granted to overprovisioned AWS IAM roles.

![The Activity Monitoring page, Snowflake tab, showing the summary tiles and Platform Metrics grid.](https://1967633068-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MZDkWMxox3pekd0NsZJ%2Fuploads%2Fgit-blob-2738132299719983cc108bf1e1a38b49ff3f841c%2Factivity-monitoring-snowflake.png?alt=media)

## Before you start

* **Early Access enablement:** Your Veza account team must enable the redesigned Activity Monitoring page for your tenant.
* **Audit log extraction:** Activity Monitoring uses the activity data collected by [Access Monitoring](/4yItIzMvkpAvMVFAamTf/features/activity-monitoring.md). Enable [audit log extraction](/4yItIzMvkpAvMVFAamTf/integrations/configuration.md#audit-log-extraction) for each platform that you want to monitor.
* **Role:** Your role must be able to view assessment reports and queries. See [Permissions](#permissions).
* **Access AI (optional):** The **Explain with Access AI** action uses [Access AI](/4yItIzMvkpAvMVFAamTf/features/access-ai.md), an Early Access feature. To use it, enable **Access AI Chat** in the **Early Access** dialog.

### Permissions

To view Activity Monitoring, the feature must be enabled for your tenant, and your role must be able to view assessment reports and queries.

* **Built-in roles with access:** **Admin**, **Operator**, **Viewer**, **Access Reviews Admin**, and **NHI Security Admin**.
* **Built-in roles without access:** **Dashboard Viewer**, **Remediation Owner**, **Access Reviewer**, **Re-assigner**, **Watcher**, and **Access Reviews Monitor**. These roles cannot open the page or load its counts.

Access is evaluated across all of a user's assigned roles, so a user who also holds one of the roles with access can still use the page. If the page or its counts do not appear for a user, confirm that their role grants assessment report and query visibility. See [Roles](/4yItIzMvkpAvMVFAamTf/administration/administration/users/roles.md).

## Platform tabs

In the left navigation, select **Access Monitoring**. The navigation item is labeled **Access Monitoring**, and the page that opens is titled **Activity Monitoring**.

Use the tabs near the top of the page to switch platforms:

* **AWS**
* **Snowflake**
* **Okta**
* **ServiceNow**

All four tabs always appear. The tab for a platform that you have not integrated, or that has no activity data yet, shows tiles with a count of zero.

The page covers these four platforms. For the other platforms that support Access Monitoring, use Query Builder. See [Supported integrations](/4yItIzMvkpAvMVFAamTf/features/activity-monitoring.md#supported-integrations).

The page URL stores the selected tab in the `tab` query parameter, so you can share a URL that opens a specific tab:

* `…/app/monitoring/activity?tab=snowflake`
* `…/app/monitoring/activity?tab=okta`
* `…/app/monitoring/activity?tab=servicenow`

AWS is the default tab and is omitted from the URL (`…/app/monitoring/activity`). Opening the page with no `tab` parameter, or with an unrecognized value, shows the AWS tab.

## Summary tiles

The tiles at the top of each tab summarize the platform's posture as donut charts. Each tile shows a count next to a total, and the donut shows the proportion. Select either number to open the underlying assessment.

The specific summary tiles depend on the platform, but follow a consistent pattern:

* **User Activity:** **Dormant** users compared to **Total Users**.
* **Role Provisioning:** **Overprovisioned** roles compared to **Total Roles**.
* **User Provisioning:** **Overprovisioned** users compared to **Total Users**.
* **User Authentication** (Okta only): users **Without MFA** compared to **Total Users**.

For how Veza determines dormant and overprovisioned status, see [Key definitions](#key-definitions). The exact tiles per platform are listed in [Metrics by platform](#metrics-by-platform).

## Platform Metrics

The **Platform Metrics** grid below the summary tiles contains one tile per query. Each tile is one predefined assessment that counts a specific risky pattern for that platform (for example, *Dormant Snowflake Databases* or *AWS IAM Roles with Dormant Access to S3 Buckets*). A tile shows:

* **Count:** The current number of results for the query (the identities, roles, or resources that it matches). For a tile with a risk level, the count excludes results whose risks have been suppressed.
* **Trend indicator:** An arrow and a value next to the count that show the direction and size of the change over the past 30 days. A flat dash indicates that the count has not changed.
* **Risk badge:** The [risk level configured on the query](/4yItIzMvkpAvMVFAamTf/features/search/saved-queries.md#assign-risk-levels-to-saved-queries), such as **High** or **Critical**. Use it to prioritize the tile relative to the others.
* **Explain with Access AI:** See [Explain with Access AI](#explain-with-access-ai).
* **Actions menu:** Options for the tile, such as **Sync with Latest Data** and **Manage Risk Details**.

The trend arrow is colored only on tiles that have a risk level, and the color follows a tenant-wide setting. By default, a decrease appears in green as an improvement, and an increase appears in red as a concern. Tiles without a risk level, such as **ServiceNow Users with Recent Activity**, show a gray arrow.

Select a tile to open its assessment.

![A single Platform Metrics tile, showing the count, trend indicator, risk badge, Explain with Access AI, and actions menu.](https://1967633068-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MZDkWMxox3pekd0NsZJ%2Fuploads%2Fgit-blob-d3cca7272d911eb174c4e4e0779b5d20d287086b%2Factivity-monitoring-tile.png?alt=media)

### View assessment results

Selecting a summary tile count or a Platform Metrics tile opens the details page for the query behind it. The details page lists the identities, roles, or resources that the tile counts, shows how the count has changed over time, and provides a link that opens the query for further investigation. See [Viewing saved query results](/4yItIzMvkpAvMVFAamTf/features/search/saved-queries.md#viewing-saved-query-results).

### Explain with Access AI

Each Platform Metrics tile has an **Explain with Access AI** action. Selecting it opens the Access AI panel and asks Access AI to explain what the tile's query detects and why it matters. Use it to understand a metric that you are not familiar with. See [Access AI](/4yItIzMvkpAvMVFAamTf/features/access-ai.md).

{% hint style="info" %}
**AI-generated content:** Explain with Access AI uses generative AI to describe what a tile's query detects. Its explanations can be inaccurate or incomplete. Before you act on an explanation, compare it with the query definition and its results, as described in [Viewing saved query results](/4yItIzMvkpAvMVFAamTf/features/search/saved-queries.md#viewing-saved-query-results).
{% endhint %}

## Key definitions

**Activity Monitoring Timeframe.** The look-back window used to decide whether an entity is active. The default is 30 days. Administrators change it under **System Settings** > **Activity Monitoring** > **Activity Monitoring Timeframe**. See [Configuration options](/4yItIzMvkpAvMVFAamTf/features/activity-monitoring.md#configuration-options) for the available values.

**Dormant.** An entity (user, role, database, application, resource, and so on) whose most recent activity is older than the Activity Monitoring Timeframe, or that has no recorded activity at all (its [Last Activity At](/4yItIzMvkpAvMVFAamTf/features/activity-monitoring.md#last-activity-at-entity-property) value is empty). Dormant counts and the summary **User Activity** tiles use this definition, except on the ServiceNow tab. On the ServiceNow tab, the **User Activity** tile counts active ServiceNow users with no table activity during the Activity Monitoring Timeframe and either no login in the last 90 days or no recorded login. Users from ServiceNow integrations without audit logging enabled are excluded.

**Overprovisioned.** An identity or role whose [Over Provisioned Access Score (OPAS)](/4yItIzMvkpAvMVFAamTf/features/activity-monitoring.md#over-provisioned-score) is 80 or higher, meaning it uses 20% or less of the access it has been granted. The summary **Role Provisioning** and **User Provisioning** tiles use this definition.

**Without MFA** (Okta). Human Okta users who have access to resources and have no active multi-factor authentication (MFA) factor. Used by the Okta **User Authentication** tile.

## Metrics by platform

The following sections list the tiles shown on each tab. Each tile's count, trend, and risk level come from its predefined assessment and update as your environment and monitoring data change.

### AWS

The **AWS** tab shows the following summary tiles:

| Tile                  | Counts                             |
| --------------------- | ---------------------------------- |
| IAM User Activity     | Dormant out of Total Users         |
| IAM Role Provisioning | Overprovisioned out of Total Roles |
| IAM User Provisioning | Overprovisioned out of Total Users |

The **AWS** tab shows the following Platform Metrics tiles:

* AWS IAM Roles with Dormant Access to KMS CMK
* AWS IAM Roles with Dormant Access to S3 Buckets
* AWS IAM Users with Dormant Access to AWS IAM Roles
* Dormant AWS IAM Roles
* Dormant S3 buckets With High Risk Score
* IAM Roles with Unused DELETE Permissions on S3 buckets, KMS CMK and Secrets Manager

### Snowflake

The **Snowflake** tab shows the following summary tiles:

| Tile                        | Counts                             |
| --------------------------- | ---------------------------------- |
| Snowflake User Activity     | Dormant out of Total Users         |
| Snowflake Role Provisioning | Overprovisioned out of Total Roles |
| Snowflake User Provisioning | Overprovisioned out of Total Users |

The **Snowflake** tab shows the following Platform Metrics tiles:

* Dormant Non-Human (NHI) Snowflake Users
* Dormant Snowflake Databases
* Dormant Snowflake Local Roles
* Snowflake Local Roles with Dormant Access on Snowflake Tables
* Snowflake Local Roles with Dormant Access to Snowflake Databases
* Snowflake Local Users with Dormant Access on Snowflake Local Roles

### Okta

The **Okta** tab shows the following summary tiles:

| Tile                     | Counts                             |
| ------------------------ | ---------------------------------- |
| Okta User Activity       | Dormant out of Total Users         |
| Okta User Authentication | Without MFA out of Total Users     |
| Okta User Provisioning   | Overprovisioned out of Total Users |

The **Okta** tab shows the following Platform Metrics tiles:

* Dormant Okta Apps
* Dormant Okta Users with Access to High-Risk Applications
* Non-Human Okta Users that are inactive and have access to S3 buckets, KMS CMK, Secrets Manager and Okta Apps
* Okta Users with Dormant Access to KMS CMK
* Okta Users with Dormant Access to S3 Buckets
* Okta Users with Dormant Access to Secrets Manager Secret

![The Activity Monitoring page, Okta tab.](https://1967633068-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MZDkWMxox3pekd0NsZJ%2Fuploads%2Fgit-blob-c7eb2a37df8493156d986b0f8e0f044d3bc2153d%2Factivity-monitoring-okta.png?alt=media)

### ServiceNow

The **ServiceNow** tab shows the following summary tiles:

| Tile                     | Counts                     |
| ------------------------ | -------------------------- |
| ServiceNow User Activity | Dormant out of Total Users |

The **ServiceNow** tab shows one Platform Metrics tile:

* ServiceNow Users with Recent Activity

![The Activity Monitoring page, ServiceNow tab.](https://1967633068-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MZDkWMxox3pekd0NsZJ%2Fuploads%2Fgit-blob-73549611c51559efcd7d9e45cc6b0142c29ded37%2Factivity-monitoring-servicenow.png?alt=media)

## Related topics

* [Access Monitoring](/4yItIzMvkpAvMVFAamTf/features/activity-monitoring.md): audit log extraction, calculated activity fields, and the Over Provisioned Access Score (OPAS).
* [Activity Monitoring for AWS](/4yItIzMvkpAvMVFAamTf/integrations/integrations/aws/activity-monitoring.md): enabling CloudTrail-based monitoring for AWS.
* [Saved Queries](/4yItIzMvkpAvMVFAamTf/features/search/saved-queries.md): the query details page that each tile opens, and how to assign risk levels.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.veza.com/4yItIzMvkpAvMVFAamTf/features/activity-monitoring/activity-monitoring-overview.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.