Discovered Apps

Discovered Apps lists the AI applications that people in your organization have actually used over a selected time window, with adoption trends and per-app detail. Use it to see what's in use, who's using it, and how risky each application is, then decide what to govern.

Prerequisites

Access to the WitnessAI Console with permission to view Discovery.
AI traffic being observed by WitnessAI so that applications can be discovered as people use them.
To block or allow applications, permission to update lists.

Review discovered apps

Open Discovery and select the Discovered Apps tab. The view opens on the Chart view.
Refine the view with the filters at the top:

Time Range: the period to analyze. Presets include Today, Yesterday, Last 7 Days, Last 30 Days, Last Week, Last Month, This Week, This Month, This Year, and All Time, plus a custom range. The default is the last 7 days.
Data Criticality: narrow to applications rated Very High, High, Medium, or Low.
Category: focus on one or more of the application categories (the same categories listed in the App Catalog).

All metrics and charts update to reflect the filters you apply. A Clear button appears when any filter is active.

Discovered Apps in the WitnessAI Console.

Switch between Chart and Table views

Discovered Apps offers two top-level views, toggled with the Chart and Table icons. The Chart view's card itself further toggles between a Bar Chart and a Map sub-view.

Chart view

The Chart view leads with four stat cards and a trend chart:

Stat card	What it shows
New this period	Applications first seen during the selected time range.
High Data Criticality	Applications rated High or Very High. Select this card to filter the whole view to high-criticality apps.
Applications	The total number of distinct applications in use.
Users	The number of users across those applications.

The chart card itself has two sub-views:

Bar Chart (Total applications by category): a stacked bar chart of application counts by category over time. Hover a bar for a per-category breakdown and total.
Map (Application headquarters by category): a world map with a marker for each vendor's headquarters country, colored by category. Hover a marker for the location, category, and count.

Tip: To jump straight to your riskiest apps, select the High Data Criticality stat card. It applies the same filter as choosing High and Very High in the Data Criticality filter.

Table view

Select the Table icon for a sortable, exportable list of every discovered application. Use the Search Apps box to find an application by name. You can sort by the Data Criticality, Country, First Seen, and Last Seen columns, and page through results (25 per page).

Table columns

Column	Description
Application	The application icon, name, and category.
Domain	The application's domain.
Data Criticality	The criticality rating, as a badge. Sortable.
Country	The vendor's headquarters country, with flag. Sortable.
First Seen	When the application was first observed. Sortable.
Last Seen	When the application was most recently observed. Sortable.
Users	The number of users who used the application.
Visits	The number of times the application was reached.
Policy	Whether the application is currently Allowed or Blocked, as a badge.
Actions	A Block or Allow button and a More actions menu. Appears only if you can update lists.

Block or allow from the table

You can block or allow applications directly from the Table view, individually or in bulk.

One application: the Actions cell shows Block while the application is allowed and Allow while it is blocked. The More actions menu next to it carries the other action, plus Remove from List when the application is on a list explicitly, which returns it to the default policy.
In bulk: select the checkbox on each application you want, then select Block or Allow in the action bar.

Blocked applications are added to your Blocked Applications list and enforced by the Application Access Policy for everyone.

Note: The block and allow controls appear only for users with permission to update lists.

Export the list

From the Table view, use the export control to download the list as a CSV file named discovered-apps.

View application details

Select an application's name to open its detail panel. The panel shows a description, category, and the application's Data Criticality rating when it has one. Fields such as Country and Data Types appear only when WitnessAI has that data for the application. It is organized into three tabs:

Tab	What it shows
Overview	A summary of the application, including Domain Name, Country, Data Types, First Seen, and Last Seen, plus the supply-chain dependencies the application relies on for data, support, and hosting.
Users	The specific users who accessed the application during the selected time range, useful for gauging how widely it's used.
Security	Compliance certifications, security practices, and authentication details, so you can assess risk against your security and compliance requirements.

Recommended action

At the top of an application's detail panel sits a card that tells you where the application currently stands with policy, and offers the action that changes it. Its title is one of four, keyed to the application's policy status, not to its Data Criticality.

Card title	What it means	What you can do
Allowed by default policy	No explicit decision has been made; the Application Access Policy allows anything not on the Blocked Applications list.	Block it, or leave it.
Blocked by default policy	No explicit decision has been made, and the default is to block because the policy is in allowlist mode.	Allow it, or leave it.
Allowed by user decision	Someone put the application on the Allowed Applications list.	Block it, or remove it from the list to fall back to the default.
Blocked by user decision	Someone put the application on the Blocked Applications list.	Allow it, or remove it from the list to fall back to the default.

The card's description names the list involved and what each button does, so you can act without leaving the panel. Blocking adds the application to your Blocked Applications list, where the Application Access Policy enforces it for everyone.

Note: The recommended-action card appears only for users with permission to view policies, and its Block and Allow controls appear only for users with permission to update lists.

See which users use an app, and which apps a user uses

The detail panel works in both directions: from an application to its users, and from a user to their applications.

Find the users of an application:

Filter to the application you want to investigate.
Open its detail panel and select the Users tab to see everyone who used it.

Find the applications a user uses:

Open the Users tab and select a user.
In the user's detail view, select the Applications tab to list the applications that person has used.

Verify

After blocking an application from the Table view, the button in that row changes to Allow and the Policy badge reads Blocked, indicating the block is active. Open Lists and open the Blocked Applications list to confirm the application appears there as well. After switching between the Chart and Table views, confirm the display updates to reflect the currently active filters.

Discovered Apps Prerequisites Review discovered apps Switch between Chart and Table views Chart view Table view Table columns Block or allow from the table Export the list View application details Recommended action See which users use an app, and which apps a user uses Verify