> For the complete documentation index, see [llms.txt](https://docs.panther.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.panther.com/data-onboarding/supported-logs/claude-code.md). # Anthropic Claude Code Telemetry (Beta) ## Overview {% hint style="info" %} Claude Code Telemetry log ingestion is in open beta starting with Panther version 1.127 and is available to all customers. Please share any bug reports and feature requests with your Panther support team. {% endhint %} Claude Code is Anthropic's agentic command-line coding tool. When telemetry is enabled, it exports usage data through OpenTelemetry (OTel), including sessions, token and cost usage, tool activity, permission decisions, and API/auth events. Panther ingests Claude Code's OTLP log events in real time, normalizes them through the `Anthropic.ClaudeTelemetry` schema, and enables security and platform teams to monitor adoption, spend, and risky activity across their developer fleet. ## Prerequisites * Claude Code installed and configured. * Administrator access to your Claude Code organization (to deploy managed settings). ## How to onboard Claude Code telemetry to Panther ### Step 1: Create an OTLP log source in Panther 1. In the left-hand navigation bar of your Panther Console, click **Configure** > **Log Sources**. 2. Click **Create New**. 3. Search for "Claude Code" and click its tile. 4. On the **Configure** page, provide: * **Source Name**: Enter a descriptive name like `Claude Code Telemetry`. * **Schemas**: The `Anthropic.ClaudeTelemetry` schema will be automatically selected. 5. In the **Authentication** section: * **Auth method**: Bearer (pre-selected for OTLP sources). * **Bearer Token**: Generate and securely copy the bearer token value. 6. Click **Setup**. 7. Note the **OTLP Endpoint URL** from the success screen — you'll need this for Claude Code configuration. ### Step 2: Configure Claude Code telemetry via managed settings The recommended way to enable Claude Code telemetry across your developer fleet is through the Claude Code [managed settings](https://code.claude.com/docs/en/monitoring-usage#quick-start) file. As an administrator, navigate to **Organization Settings** > **Claude Code** > **Managed settings** in your Claude organization and deploy a configuration like the following: ```json { "env": { "CLAUDE_CODE_ENABLE_TELEMETRY": "1", "OTEL_LOGS_EXPORTER": "otlp", "OTEL_EXPORTER_OTLP_LOGS_PROTOCOL": "http/json", "OTEL_EXPORTER_OTLP_LOGS_ENDPOINT": "", "OTEL_EXPORTER_OTLP_HEADERS": "Authorization=Bearer " } } ``` Replace `` and `` with the values from Step 1. Managed settings are pushed centrally to every Claude Code installation in your organization, giving you a single, auditable place to control telemetry. See [Claude Code settings precedence](https://code.claude.com/docs/en/monitoring-usage#quick-start) for how managed settings interact with user-level configuration. #### Alternative: per-user environment variables For local testing or installations not yet covered by managed settings, the same configuration can be applied as shell environment variables: ```bash export CLAUDE_CODE_ENABLE_TELEMETRY=1 export OTEL_LOGS_EXPORTER=otlp export OTEL_EXPORTER_OTLP_LOGS_PROTOCOL=http/json export OTEL_EXPORTER_OTLP_LOGS_ENDPOINT= export OTEL_EXPORTER_OTLP_HEADERS="Authorization=Bearer " ``` #### Privacy controls Claude Code provides granular privacy controls. Set these in the same `env` block (managed settings) or as environment variables: * **`OTEL_LOG_USER_PROMPTS=1`**: Includes actual prompt content in telemetry (redacted by default). * **`OTEL_LOG_TOOL_DETAILS=1`**: Includes detailed tool parameters, hook configurations, and error details. * **`OTEL_LOG_RAW_API_BODIES=file:`**: Logs full API request/response bodies to files in the given directory. ### Step 3: Test the integration 1. From a machine that has received the managed settings (or your local shell with the env vars set), run Claude Code: ```bash claude "Hello, can you help me write a simple Python script?" ``` 2. In the Panther Console, navigate to your Claude Code log source and verify: * **Source Status** shows as "Healthy". * Recent events appear in the **Events** section. * Event processing is working correctly. ## Supported log types ### Anthropic.ClaudeTelemetry ```yaml schema: Anthropic.ClaudeTelemetry description: | Claude Code/Cowork telemetry events, emitted by the tool. The populated attribute set depends on the event type (`attributes.event_name`); see the Claude Code monitoring docs for the per-event details. referenceURL: https://code.claude.com/docs/en/monitoring-usage fields: - name: timeUnixNano required: true description: Event time, nanoseconds since the UNIX epoch. type: timestamp timeFormats: - unix_ns isEventTime: true - name: observedTimeUnixNano description: Time the event was observed, nanoseconds since the UNIX epoch. type: timestamp timeFormats: - unix_ns - name: body required: true description: The fully-qualified event name, e.g. "claude_code.user_prompt". type: string - name: droppedAttributesCount description: Number of attributes dropped due to limits. type: bigint - name: attributes description: | Event attributes. The populated subset depends on the event type (`attributes.event_name`); see the Claude Code monitoring docs for the per-event attribute lists. type: object fields: # --- Standard attributes (present on every event when available) --- - name: event_name description: Short event name, e.g. "user_prompt", "tool_result", "api_request". type: string - name: event_timestamp description: Event timestamp (ISO 8601 / RFC3339). type: timestamp timeFormats: - rfc3339 - name: event_sequence description: Monotonically increasing counter ordering events within a session. type: bigint - name: session_id description: Unique session identifier (from session.id). type: string indicators: - trace_id - name: prompt_id description: UUID correlating a user prompt with all events it triggers (from prompt.id). type: string indicators: - trace_id - name: app_version description: Claude Code version (from app.version). type: string - name: app_entrypoint description: How the session was launched, e.g. cli, sdk-cli, sdk-ts, sdk-py, claude-vscode (from app.entrypoint). type: string - name: organization_id description: Organization UUID when authenticated (from organization.id). type: string - name: user_id description: Random anonymous per-machine identifier (from user.id). type: string indicators: - actor_id - name: user_account_id description: Account ID in Anthropic admin-API tagged format, e.g. user_01... (from user.account_id). type: string - name: user_account_uuid description: Account UUID when authenticated (from user.account_uuid). type: string - name: user_email description: User email when authenticated via OAuth (from user.email). type: string indicators: - email - name: terminal_type description: Terminal type, e.g. iTerm.app, vscode, cursor, tmux (from terminal.type). type: string - name: workspace_host_paths description: Host workspace directories selected in the desktop app (from workspace.host_paths). type: array element: type: string # --- user_prompt --- - name: prompt description: Prompt content. Redacted unless OTEL_LOG_USER_PROMPTS=1. type: string - name: prompt_length description: Length of the prompt. type: bigint - name: command_name description: Command name when the prompt invokes one (e.g. compact); custom/plugin/mcp collapse unless OTEL_LOG_TOOL_DETAILS=1. type: string - name: command_source description: Origin of the command, one of builtin, custom, mcp. type: string # --- tool_result / tool_decision --- - name: tool_name description: Name of the tool, e.g. Read, Edit, Write, Bash. type: string - name: tool_use_id description: Unique identifier for this tool invocation; matches the tool_use_id passed to hooks. type: string - name: success description: Whether the operation succeeded ("true"/"false"). Used by tool_result, auth, at_mention, compaction. type: boolean - name: duration_ms description: Duration in milliseconds. Used by tool_result, api_request, api_error, mcp_server_connection, compaction. type: bigint - name: error_type description: Error category string when a tool failed, e.g. "Error:ENOENT", "ShellError". type: string - name: decision description: Permission decision, "accept" or "reject" (tool_decision). type: string - name: decision_type description: Resolved decision type; always "accept" on tool_result. type: string - name: decision_source description: Where the permission decision came from, e.g. config, hook, user_permanent, user_temporary, user_abort, user_reject. type: string - name: source description: Where the tool_decision came from (config, hook, user_permanent, user_temporary, user_abort, user_reject). type: string - name: mcp_server_scope description: MCP server scope identifier (for MCP tools). type: string - name: tool_input_size_bytes description: Size of the JSON-serialized tool input in bytes. type: bigint - name: tool_result_size_bytes description: Size of the tool result in bytes. type: bigint - name: tool_parameters description: JSON string of tool-specific parameters (when OTEL_LOG_TOOL_DETAILS=1). type: json isEmbeddedJSON: true - name: tool_input description: JSON-serialized tool arguments (when OTEL_LOG_TOOL_DETAILS=1). type: json isEmbeddedJSON: true # --- api_request / api_error / api_refusal / api_retries_exhausted --- - name: model description: Model used, e.g. claude-sonnet-4-6. type: string - name: cost_usd description: Estimated cost in USD (api_request). type: float - name: cost_usd_micros description: Estimated cost in USD millionths (api_request). type: bigint - name: input_tokens description: Number of input tokens. type: bigint - name: output_tokens description: Number of output tokens. type: bigint - name: cache_read_tokens description: Number of tokens read from cache. type: bigint - name: cache_creation_tokens description: Number of tokens used for cache creation. type: bigint - name: request_id description: Anthropic API request id from the response request-id header, e.g. req_011... type: string - name: speed description: '"fast" or "normal", indicating whether fast mode was active.' type: string - name: query_source description: Subsystem that issued the request, e.g. repl_main_thread, compact, or a subagent name. type: string - name: effort description: Effort level applied to the request, e.g. low, medium, high, xhigh, max. type: string - name: error description: Error message (api_error, api_retries_exhausted, compaction, mcp_server_connection when OTEL_LOG_TOOL_DETAILS=1). type: string - name: status_code description: HTTP status code. Number on api_error/api_retries_exhausted, string on auth. type: bigint - name: attempt description: Total number of attempts made including the initial request (api_error). type: bigint - name: total_attempts description: Total number of attempts made (api_retries_exhausted). type: bigint - name: total_retry_duration_ms description: Total wall-clock time across all attempts (api_retries_exhausted). type: bigint - name: server_fallback_hop description: "True when the API's server-side model fallback already retried this refusal on a different model, so the user did not see it; false when the request ended in a refusal (api_refusal)." type: boolean - name: has_category description: True when the API response carried a stop_details.category (cyber, bio, frontier_llm, reasoning_extraction); absent when server_fallback_hop is true (api_refusal). type: boolean - name: has_explanation description: True when the API response carried a stop_details.explanation; absent when server_fallback_hop is true (api_refusal). type: boolean - name: category description: The stop_details.category value, one of cyber, bio, frontier_llm, reasoning_extraction; only present when OTEL_LOG_TOOL_DETAILS=1 and has_category is true (api_refusal). type: string - name: agent_name description: Agent attribution for the request (from agent.name). type: string - name: skill_name description: Skill attribution / activated skill name (from skill.name). type: string - name: skill_source description: Where a skill was loaded from, e.g. bundled, userSettings, projectSettings, plugin (from skill.source). type: string - name: skill_kind description: '"workflow" when the skill is a workflow skill (from skill.kind).' type: string - name: invocation_trigger description: How a skill was triggered, e.g. user-slash, claude-proactive, nested-skill. type: string - name: plugin_name description: Plugin name; "third-party" for third-party plugins unless OTEL_LOG_TOOL_DETAILS=1 (from plugin.name). type: string - name: plugin_version description: Plugin version (from plugin.version). type: string - name: plugin_scope description: Plugin provenance, e.g. official, org, user-local, default-bundle (from plugin.scope). type: string - name: plugin_id description: Plugin identifier in @ form (hook_plugin_metrics). type: string - name: plugin_id_hash description: Deterministic hash of plugin name + marketplace, for fleet counting without exposing names. type: string - name: marketplace_name description: Marketplace a plugin was installed from (from marketplace.name). type: string - name: marketplace_is_official description: Whether the marketplace is an official Anthropic marketplace (from marketplace.is_official). type: boolean - name: install_trigger description: How a plugin was installed, "cli" or "ui" (from install.trigger). type: string - name: enabled_via description: How a plugin came to be enabled, e.g. default-enable, org-policy, seed-mount, user-install. type: string - name: has_hooks description: Whether the plugin contributes hooks. type: boolean - name: has_mcp description: Whether the plugin contributes MCP servers. type: boolean - name: host_owned_mcp description: Whether the SDK host manages this plugin's MCP connections. type: boolean - name: skill_path_count description: Number of skill directories the plugin declares. type: bigint - name: command_path_count description: Number of command directories the plugin declares. type: bigint - name: agent_path_count description: Number of agent directories the plugin declares. type: bigint - name: safe_mode description: Whether the session was started with --safe-mode. type: boolean - name: mcp_server_name description: MCP server name attribution for an api_request (from mcp_server.name). type: string - name: mcp_tool_name description: MCP tool name attribution for an api_request (from mcp_tool.name). type: string # --- api_request_body / api_response_body --- - name: body_ref description: Absolute path to a file with the untruncated body (file mode, OTEL_LOG_RAW_API_BODIES=file:). type: string - name: body_length description: Untruncated body length (UTF-8 bytes in file mode, UTF-16 code units inline). type: bigint - name: body_truncated description: '"true" when inline truncation occurred. Absent in file mode and when no truncation occurred.' type: boolean # --- permission_mode_changed --- - name: from_mode description: Previous permission mode, e.g. default, plan, acceptEdits, auto, bypassPermissions. type: string - name: to_mode description: New permission mode. type: string - name: trigger description: What caused the change/compaction, e.g. shift_tab, exit_plan_mode, auto_gate_denied, auto_opt_in (permission_mode_changed); auto, manual (compaction). type: string # --- auth --- - name: action description: '"login" or "logout" (auth).' type: string - name: auth_method description: Authentication method, e.g. oauth (auth). type: string - name: error_category description: Categorical error kind when an action failed; the raw message is never included (auth). type: string # --- mcp_server_connection --- - name: status description: '"connected", "failed", or "disconnected" (mcp_server_connection).' type: string - name: transport_type description: MCP server transport, e.g. stdio, sse, http. type: string - name: server_scope description: Scope the MCP server is configured at, e.g. user, project, local. type: string - name: error_code description: Error code when an MCP connection (or internal error) occurred. type: string - name: is_plugin description: Whether the MCP server is provided by a plugin. type: boolean - name: server_name description: Configured MCP server name (when OTEL_LOG_TOOL_DETAILS=1). type: string # --- internal_error --- - name: error_name description: Error class name, e.g. TypeError, SyntaxError (internal_error). type: string # --- at_mention --- - name: mention_type description: Type of mention resolved, e.g. file, directory, agent, mcp_resource. type: string # --- hook_registered / hook_execution_start / hook_execution_complete / hook_plugin_metrics --- - name: hook_event description: Hook event type, e.g. PreToolUse, PostToolUse, UserPromptSubmit, PermissionRequest. type: string - name: hook_type description: Hook implementation type, e.g. command, prompt, mcp_tool, http, agent (hook_registered). type: string - name: hook_source description: Where the hook is defined, e.g. userSettings, projectSettings, localSettings, policySettings, pluginHook, merged. type: string - name: hook_name description: Full hook name including matcher, e.g. PreToolUse:Write. type: string - name: hook_matcher description: Matcher string from the hook configuration (when OTEL_LOG_TOOL_DETAILS=1). type: string - name: hook_definitions description: JSON-serialized hook configuration (detailed beta tracing + OTEL_LOG_TOOL_DETAILS=1). type: string - name: num_hooks description: Number of matching hook commands. type: bigint - name: num_success description: Count of hooks that completed successfully. type: bigint - name: num_blocking description: Count of hooks that returned a blocking decision. type: bigint - name: num_non_blocking_error description: Count of hooks that failed without blocking. type: bigint - name: num_cancelled description: Count of hooks cancelled before completion. type: bigint - name: total_duration_ms description: Wall-clock duration of all matching hooks. type: bigint - name: managed_only description: '"true" when only managed-policy hooks are permitted.' type: boolean # --- compaction --- - name: pre_tokens description: Approximate token count before compaction. type: bigint - name: post_tokens description: Approximate token count after compaction. type: bigint - name: precompute_reuse description: Whether /compact reused a prepared summary; hit, miss_custom_instructions, miss_hook, miss_not_ready (manual compaction only). type: string # --- feedback_survey --- - name: event_type description: Survey lifecycle event, e.g. appeared, responded, transcript_prompt_appeared. type: string - name: appearance_id description: Unique id linking the events emitted for one survey instance. type: string - name: survey_type description: Which survey produced the event, e.g. session. type: string - name: response description: The user's selection on responded events. type: string - name: enabled_via_override description: True when CLAUDE_CODE_ENABLE_FEEDBACK_SURVEY_FOR_OTEL is set. type: boolean ``` --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.panther.com/data-onboarding/supported-logs/claude-code.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.