Anthropic Claude Cowork Telemetry (Beta)

Monitor Claude Cowork usage, cost, and activity via OpenTelemetry (OTLP)

Overview

Claude Cowork Telemetry log ingestion is in open beta starting with Panther version 1.127 and is available to all customers. Please share any bug reports and feature requests with your Panther support team.

Claude Cowork is Anthropic's collaborative AI workspace. When telemetry is enabled, it exports usage data through OpenTelemetry (OTel), including sessions, token and cost usage, tool activity, permission decisions, and API errors.

Panther ingests Claude Cowork's OTLP log events in real time, normalizes them through the Anthropic.ClaudeTelemetry schema, and enables security and platform teams to monitor adoption, spend, and risky activity across their organization.

Prerequisites

• Access to a Claude Cowork workspace.

• Administrator access to your Claude Cowork organization.

How to onboard Claude Cowork telemetry to Panther

Step 1: Create an OTLP log source in Panther

1. In the left-hand navigation bar of your Panther Console, click Log Sources.

2. Click Create New.

3. Search for "Claude Cowork" and click its tile.

4. On the Configure page, provide:

   • Source Name: Enter a descriptive name like Claude Cowork Telemetry.

   • Schemas: The Anthropic.ClaudeTelemetry schema will be automatically selected.

5. In the Authentication section:

   • Auth method: Bearer (pre-selected for OTLP sources).

   • Bearer Token: Generate and securely copy the bearer token value.

6. Click Setup.

7. Note the OTLP Endpoint URL from the success screen — you'll need this for Claude Cowork configuration.

Step 2: Configure Claude Cowork telemetry

Claude Cowork telemetry is configured by an administrator from the Claude Cowork UI:

1. Navigate to Admin settings > Cowork.

2. Fill in the OTLP fields using the values from Step 1:

   {
     "OTLP endpoint": "<your_panther_otlp_endpoint_url>",
     "OTLP protocol": "http/json",
     "OTLP headers": "Authorization=Bearer <your_bearer_token>"
   }

3. Click Save. Settings are loaded at session start, so users may need to start a new Cowork session for the change to take effect.

Step 3: Test the integration

1. Perform activity in your Claude Cowork workspace (e.g., start a session and invoke a tool).

2. In the Panther Console, navigate to your Claude Cowork log source and verify:

   • Source Status shows as "Healthy".

   • Recent events appear in the Events section.

   • Event processing is working correctly.

Supported log types

Anthropic.ClaudeTelemetry

schema: Anthropic.ClaudeTelemetry
description: |
  Claude Code/Cowork telemetry events, emitted by the tool. The populated
  attribute set depends on the event type (`attributes.event_name`); see the
  Claude Code monitoring docs for the per-event details.
referenceURL: https://code.claude.com/docs/en/monitoring-usage
fields:
  - name: timeUnixNano
    required: true
    description: Event time, nanoseconds since the UNIX epoch.
    type: timestamp
    timeFormats:
      - unix_ns
    isEventTime: true
  - name: observedTimeUnixNano
    description: Time the event was observed, nanoseconds since the UNIX epoch.
    type: timestamp
    timeFormats:
      - unix_ns
  - name: body
    required: true
    description: The fully-qualified event name, e.g. "claude_code.user_prompt".
    type: string
  - name: droppedAttributesCount
    description: Number of attributes dropped due to limits.
    type: bigint
  - name: attributes
    description: |
      Event attributes. The populated subset depends on the event type
      (`attributes.event_name`); see the Claude Code monitoring docs for the
      per-event attribute lists.
    type: object
    fields:
      # --- Standard attributes (present on every event when available) ---
      - name: event_name
        description: Short event name, e.g. "user_prompt", "tool_result", "api_request".
        type: string
      - name: event_timestamp
        description: Event timestamp (ISO 8601 / RFC3339).
        type: timestamp
        timeFormats:
          - rfc3339
      - name: event_sequence
        description: Monotonically increasing counter ordering events within a session.
        type: bigint
      - name: session_id
        description: Unique session identifier (from session.id).
        type: string
        indicators:
          - trace_id
      - name: prompt_id
        description: UUID correlating a user prompt with all events it triggers (from prompt.id).
        type: string
        indicators:
          - trace_id
      - name: app_version
        description: Claude Code version (from app.version).
        type: string
      - name: app_entrypoint
        description: How the session was launched, e.g. cli, sdk-cli, sdk-ts, sdk-py, claude-vscode (from app.entrypoint).
        type: string
      - name: organization_id
        description: Organization UUID when authenticated (from organization.id).
        type: string
      - name: user_id
        description: Random anonymous per-machine identifier (from user.id).
        type: string
        indicators:
          - actor_id
      - name: user_account_id
        description: Account ID in Anthropic admin-API tagged format, e.g. user_01... (from user.account_id).
        type: string
      - name: user_account_uuid
        description: Account UUID when authenticated (from user.account_uuid).
        type: string
      - name: user_email
        description: User email when authenticated via OAuth (from user.email).
        type: string
        indicators:
          - email
      - name: terminal_type
        description: Terminal type, e.g. iTerm.app, vscode, cursor, tmux (from terminal.type).
        type: string
      - name: workspace_host_paths
        description: Host workspace directories selected in the desktop app (from workspace.host_paths).
        type: array
        element:
          type: string
      # --- user_prompt ---
      - name: prompt
        description: Prompt content. Redacted unless OTEL_LOG_USER_PROMPTS=1.
        type: string
      - name: prompt_length
        description: Length of the prompt.
        type: bigint
      - name: command_name
        description: Command name when the prompt invokes one (e.g. compact); custom/plugin/mcp collapse unless OTEL_LOG_TOOL_DETAILS=1.
        type: string
      - name: command_source
        description: Origin of the command, one of builtin, custom, mcp.
        type: string
      # --- tool_result / tool_decision ---
      - name: tool_name
        description: Name of the tool, e.g. Read, Edit, Write, Bash.
        type: string
      - name: tool_use_id
        description: Unique identifier for this tool invocation; matches the tool_use_id passed to hooks.
        type: string
      - name: success
        description: Whether the operation succeeded ("true"/"false"). Used by tool_result, auth, at_mention, compaction.
        type: boolean
      - name: duration_ms
        description: Duration in milliseconds. Used by tool_result, api_request, api_error, mcp_server_connection, compaction.
        type: bigint
      - name: error_type
        description: Error category string when a tool failed, e.g. "Error:ENOENT", "ShellError".
        type: string
      - name: decision
        description: Permission decision, "accept" or "reject" (tool_decision).
        type: string
      - name: decision_type
        description: Resolved decision type; always "accept" on tool_result.
        type: string
      - name: decision_source
        description: Where the permission decision came from, e.g. config, hook, user_permanent, user_temporary, user_abort, user_reject.
        type: string
      - name: source
        description: Where the tool_decision came from (config, hook, user_permanent, user_temporary, user_abort, user_reject).
        type: string
      - name: mcp_server_scope
        description: MCP server scope identifier (for MCP tools).
        type: string
      - name: tool_input_size_bytes
        description: Size of the JSON-serialized tool input in bytes.
        type: bigint
      - name: tool_result_size_bytes
        description: Size of the tool result in bytes.
        type: bigint
      - name: tool_parameters
        description: JSON string of tool-specific parameters (when OTEL_LOG_TOOL_DETAILS=1).
        type: json
        isEmbeddedJSON: true
      - name: tool_input
        description: JSON-serialized tool arguments (when OTEL_LOG_TOOL_DETAILS=1).
        type: json
        isEmbeddedJSON: true
      # --- api_request / api_error / api_refusal / api_retries_exhausted ---
      - name: model
        description: Model used, e.g. claude-sonnet-4-6.
        type: string
      - name: cost_usd
        description: Estimated cost in USD (api_request).
        type: float
      - name: cost_usd_micros
        description: Estimated cost in USD millionths (api_request).
        type: bigint
      - name: input_tokens
        description: Number of input tokens.
        type: bigint
      - name: output_tokens
        description: Number of output tokens.
        type: bigint
      - name: cache_read_tokens
        description: Number of tokens read from cache.
        type: bigint
      - name: cache_creation_tokens
        description: Number of tokens used for cache creation.
        type: bigint
      - name: request_id
        description: Anthropic API request id from the response request-id header, e.g. req_011...
        type: string
      - name: speed
        description: '"fast" or "normal", indicating whether fast mode was active.'
        type: string
      - name: query_source
        description: Subsystem that issued the request, e.g. repl_main_thread, compact, or a subagent name.
        type: string
      - name: effort
        description: Effort level applied to the request, e.g. low, medium, high, xhigh, max.
        type: string
      - name: error
        description: Error message (api_error, api_retries_exhausted, compaction, mcp_server_connection when OTEL_LOG_TOOL_DETAILS=1).
        type: string
      - name: status_code
        description: HTTP status code. Number on api_error/api_retries_exhausted, string on auth.
        type: bigint
      - name: attempt
        description: Total number of attempts made including the initial request (api_error).
        type: bigint
      - name: total_attempts
        description: Total number of attempts made (api_retries_exhausted).
        type: bigint
      - name: total_retry_duration_ms
        description: Total wall-clock time across all attempts (api_retries_exhausted).
        type: bigint
      - name: server_fallback_hop
        description: "True when the API's server-side model fallback already retried this refusal on a different model, so the user did not see it; false when the request ended in a refusal (api_refusal)."
        type: boolean
      - name: has_category
        description: True when the API response carried a stop_details.category (cyber, bio, frontier_llm, reasoning_extraction); absent when server_fallback_hop is true (api_refusal).
        type: boolean
      - name: has_explanation
        description: True when the API response carried a stop_details.explanation; absent when server_fallback_hop is true (api_refusal).
        type: boolean
      - name: category
        description: The stop_details.category value, one of cyber, bio, frontier_llm, reasoning_extraction; only present when OTEL_LOG_TOOL_DETAILS=1 and has_category is true (api_refusal).
        type: string
      - name: agent_name
        description: Agent attribution for the request (from agent.name).
        type: string
      - name: skill_name
        description: Skill attribution / activated skill name (from skill.name).
        type: string
      - name: skill_source
        description: Where a skill was loaded from, e.g. bundled, userSettings, projectSettings, plugin (from skill.source).
        type: string
      - name: skill_kind
        description: '"workflow" when the skill is a workflow skill (from skill.kind).'
        type: string
      - name: invocation_trigger
        description: How a skill was triggered, e.g. user-slash, claude-proactive, nested-skill.
        type: string
      - name: plugin_name
        description: Plugin name; "third-party" for third-party plugins unless OTEL_LOG_TOOL_DETAILS=1 (from plugin.name).
        type: string
      - name: plugin_version
        description: Plugin version (from plugin.version).
        type: string
      - name: plugin_scope
        description: Plugin provenance, e.g. official, org, user-local, default-bundle (from plugin.scope).
        type: string
      - name: plugin_id
        description: Plugin identifier in <name>@<marketplace> form (hook_plugin_metrics).
        type: string
      - name: plugin_id_hash
        description: Deterministic hash of plugin name + marketplace, for fleet counting without exposing names.
        type: string
      - name: marketplace_name
        description: Marketplace a plugin was installed from (from marketplace.name).
        type: string
      - name: marketplace_is_official
        description: Whether the marketplace is an official Anthropic marketplace (from marketplace.is_official).
        type: boolean
      - name: install_trigger
        description: How a plugin was installed, "cli" or "ui" (from install.trigger).
        type: string
      - name: enabled_via
        description: How a plugin came to be enabled, e.g. default-enable, org-policy, seed-mount, user-install.
        type: string
      - name: has_hooks
        description: Whether the plugin contributes hooks.
        type: boolean
      - name: has_mcp
        description: Whether the plugin contributes MCP servers.
        type: boolean
      - name: host_owned_mcp
        description: Whether the SDK host manages this plugin's MCP connections.
        type: boolean
      - name: skill_path_count
        description: Number of skill directories the plugin declares.
        type: bigint
      - name: command_path_count
        description: Number of command directories the plugin declares.
        type: bigint
      - name: agent_path_count
        description: Number of agent directories the plugin declares.
        type: bigint
      - name: safe_mode
        description: Whether the session was started with --safe-mode.
        type: boolean
      - name: mcp_server_name
        description: MCP server name attribution for an api_request (from mcp_server.name).
        type: string
      - name: mcp_tool_name
        description: MCP tool name attribution for an api_request (from mcp_tool.name).
        type: string
      # --- api_request_body / api_response_body ---
      - name: body_ref
        description: Absolute path to a file with the untruncated body (file mode, OTEL_LOG_RAW_API_BODIES=file:<dir>).
        type: string
      - name: body_length
        description: Untruncated body length (UTF-8 bytes in file mode, UTF-16 code units inline).
        type: bigint
      - name: body_truncated
        description: '"true" when inline truncation occurred. Absent in file mode and when no truncation occurred.'
        type: boolean
      # --- permission_mode_changed ---
      - name: from_mode
        description: Previous permission mode, e.g. default, plan, acceptEdits, auto, bypassPermissions.
        type: string
      - name: to_mode
        description: New permission mode.
        type: string
      - name: trigger
        description: What caused the change/compaction, e.g. shift_tab, exit_plan_mode, auto_gate_denied, auto_opt_in (permission_mode_changed); auto, manual (compaction).
        type: string
      # --- auth ---
      - name: action
        description: '"login" or "logout" (auth).'
        type: string
      - name: auth_method
        description: Authentication method, e.g. oauth (auth).
        type: string
      - name: error_category
        description: Categorical error kind when an action failed; the raw message is never included (auth).
        type: string
      # --- mcp_server_connection ---
      - name: status
        description: '"connected", "failed", or "disconnected" (mcp_server_connection).'
        type: string
      - name: transport_type
        description: MCP server transport, e.g. stdio, sse, http.
        type: string
      - name: server_scope
        description: Scope the MCP server is configured at, e.g. user, project, local.
        type: string
      - name: error_code
        description: Error code when an MCP connection (or internal error) occurred.
        type: string
      - name: is_plugin
        description: Whether the MCP server is provided by a plugin.
        type: boolean
      - name: server_name
        description: Configured MCP server name (when OTEL_LOG_TOOL_DETAILS=1).
        type: string
      # --- internal_error ---
      - name: error_name
        description: Error class name, e.g. TypeError, SyntaxError (internal_error).
        type: string
      # --- at_mention ---
      - name: mention_type
        description: Type of mention resolved, e.g. file, directory, agent, mcp_resource.
        type: string
      # --- hook_registered / hook_execution_start / hook_execution_complete / hook_plugin_metrics ---
      - name: hook_event
        description: Hook event type, e.g. PreToolUse, PostToolUse, UserPromptSubmit, PermissionRequest.
        type: string
      - name: hook_type
        description: Hook implementation type, e.g. command, prompt, mcp_tool, http, agent (hook_registered).
        type: string
      - name: hook_source
        description: Where the hook is defined, e.g. userSettings, projectSettings, localSettings, policySettings, pluginHook, merged.
        type: string
      - name: hook_name
        description: Full hook name including matcher, e.g. PreToolUse:Write.
        type: string
      - name: hook_matcher
        description: Matcher string from the hook configuration (when OTEL_LOG_TOOL_DETAILS=1).
        type: string
      - name: hook_definitions
        description: JSON-serialized hook configuration (detailed beta tracing + OTEL_LOG_TOOL_DETAILS=1).
        type: string
      - name: num_hooks
        description: Number of matching hook commands.
        type: bigint
      - name: num_success
        description: Count of hooks that completed successfully.
        type: bigint
      - name: num_blocking
        description: Count of hooks that returned a blocking decision.
        type: bigint
      - name: num_non_blocking_error
        description: Count of hooks that failed without blocking.
        type: bigint
      - name: num_cancelled
        description: Count of hooks cancelled before completion.
        type: bigint
      - name: total_duration_ms
        description: Wall-clock duration of all matching hooks.
        type: bigint
      - name: managed_only
        description: '"true" when only managed-policy hooks are permitted.'
        type: boolean
      # --- compaction ---
      - name: pre_tokens
        description: Approximate token count before compaction.
        type: bigint
      - name: post_tokens
        description: Approximate token count after compaction.
        type: bigint
      - name: precompute_reuse
        description: Whether /compact reused a prepared summary; hit, miss_custom_instructions, miss_hook, miss_not_ready (manual compaction only).
        type: string
      # --- feedback_survey ---
      - name: event_type
        description: Survey lifecycle event, e.g. appeared, responded, transcript_prompt_appeared.
        type: string
      - name: appearance_id
        description: Unique id linking the events emitted for one survey instance.
        type: string
      - name: survey_type
        description: Which survey produced the event, e.g. session.
        type: string
      - name: response
        description: The user's selection on responded events.
        type: string
      - name: enabled_via_override
        description: True when CLAUDE_CODE_ENABLE_FEEDBACK_SURVEY_FOR_OTEL is set.
        type: boolean