Skip to main content
The Island connector reads browser audit events from the Island Enterprise Browser and counts visits to AI services. Each AI service then appears in your Shadow AI discovery findings, counted in browser navigations, with blocked attempts counted separately.
This page covers Shadow AI discovery. To import the AI conversations Island AI Protect captures, see Island AI Protect. The two connect separately.
The Island connector is turned on separately from Shadow AI discovery. If it isn’t in the Connectors dialog, reach out to us to turn it on.

​
Choose pull or push

Both modes count events the same way and store the same data.

​
What Openlayer reads

  • Navigation events to AI tools. An event’s tool is matched by the host of its page (top_level_url), then by Island’s app name (saas_application_name, matched exactly against the catalog), then by an AI web category for sites the catalog doesn’t know.
  • Blocked attempts. An event whose verdict is a block counts as a blocked attempt, never as usage.
  • The user’s email. A masked or missing email is counted as an unknown user. Openlayer never uses Island’s user name or user ID instead.
  • No content. Island’s audit events carry no prompts or responses, and screenshot references are ignored.
Everything else is counted by reason on the connector card and discarded: logins, screen recordings, embedded frames, non-AI sites, and unrecognized verdicts. Events with no timestamp, from another Island tenant, older than 30 days, or more than an hour in the future are rejected.

​
Prerequisites

  • Shadow AI discovery and the Island connector turned on for your deployment.
  • An Island admin with the Full Admin or System Admin role.
  • An Island logging policy that logs navigation events for the users and sites you want covered. Openlayer only sees what Island logs, and only inside the Island browser.
  • Someone who can set an environment variable where Openlayer runs. If Openlayer hosts your deployment, that’s us.

​
Set up pull

1

Generate an API key and copy the Audit ID

In the Island Management Console, go to Modules → Platform Settings → System Settings → Integrations → SIEM, and click Setup for the Generic SIEM Integration.
  • Click Generate API Key. Island shows the key only once, so copy it.
  • Copy the Audit ID shown for the SIEM connector.
Give Openlayer its own Audit ID. The SIEM API is a queue, and acknowledging a batch removes it for every reader. If another SIEM reads the same Audit ID, the two would split the events between them.
2

Put the API key in an environment variable

Set the key in an environment variable where Openlayer runs, such as ISLAND_API_KEY, and restart Openlayer. If Openlayer hosts your deployment, coordinate with us to set it.The admin portal stores only the variable’s name, never the key.
3

Connect Island

In the admin portal, go to Shadow AI → Discovery, click Connect, choose Island, and select Pull. Fill in:
  • Island tenant ID: your tenant’s ID, as Island’s events carry it in tenant_id. Every event is checked against it.
  • Island API URL: the host that serves Island’s SIEM API for your tenant, such as https://api.island.io. It must be an https URL on island.io.
  • SIEM Audit ID: the Audit ID from the first step.
  • API key env var: the variable from the previous step. It defaults to ISLAND_API_KEY.
Click Connect. Openlayer reads the queue once to check the settings, without acknowledging anything. If the key or Audit ID is wrong, the error says which.The first sync starts right away.

​
How Openlayer reads

  • It syncs every 5 minutes. Click Sync now on the card to start one immediately. Only one sync runs at a time.
  • It drains the queue in order. Island hands out the oldest batch first. Each sync reads up to 20 batches, and keeps going while Island reports more queued, so a large backlog drains over a few syncs.
  • It acknowledges a batch only after storing it. If a sync is cut off, or an acknowledgement fails, the batch stays queued. Island hands it out again, and events already counted aren’t counted again.
  • It doesn’t let one bad batch block the queue. If a batch fails to store 3 times in a row, Openlayer acknowledges it without storing it so the queue keeps draining, and the card shows a warning.
  • There’s no backfill. Island’s queue starts when the API key is generated, so events from before that aren’t available.

​
Set up push

Push needs Island to reach Openlayer over HTTPS, so your deployment must accept inbound traffic from Island. Island sends the receiver secret in a header. Openlayer doesn’t accept it in the URL.
1

Generate a receiver secret

Generate a random secret of at least 24 characters, for example with openssl rand -hex 32. Set it in an environment variable where Openlayer runs, such as ISLAND_WEBHOOK_SECRET, and restart Openlayer.
2

Connect Island

In the admin portal, go to Shadow AI → Discovery, click Connect, choose Island, and select Push. Fill in the Island tenant ID and the Receiver secret env var, then click Connect.The card then shows the Receiver URL, https://<your-openlayer-host>/v1/discovery/island/events, and the Auth header Island must send: Authorization: Bearer <secret>. If Island can send a custom header but not Authorization, contact us to use a different header name.
3

Add the receiver in Island

In the Island Management Console, go to Modules → Platform Settings → System Settings → Integrations → SIEM, and set up the Generic SIEM Integration with the receiver URL as its Server URL and the auth header.Run Island’s connection check. Openlayer answers it, and the card shows Connection check received.

​
How Openlayer handles a delivery

  • It accepts NDJSON, a JSON array, or a single JSON object, optionally gzipped, up to 10 MB compressed and 32 MB decoded.
  • It answers with a 2xx only after the events are stored. A retried or replayed delivery is recognized, and its events are counted as duplicates rather than counted again.

​
How findings appear

  • Findings are counted in browser navigations: visits to an AI tool in the Island browser. A count isn’t a prompt count.
  • Blocked attempts are reported separately and never count as usage.
  • Per-user figures come from the event’s email.
Openlayer stores per-minute counts by tool, host, user email, and whether the visit was allowed or blocked, for 30 days, plus the IDs of events it has already counted. It never stores raw events.

​
The connector card

Open Connect on the Discovery page to see the Island card. It shows:
  • Totals: AI browser events stored, duplicates, events that weren’t AI usage, and rejected events.
  • Pull: what the last sync read, and a warning if a batch was skipped after 3 failed attempts.
  • Push: the receiver URL and auth header, why the last delivery dropped events, and how many deliveries arrived with a wrong or missing secret.
  • A warning when a batch or delivery was stored but some of its events were rejected, and an error when a whole delivery was lost, usually to a wrong tenant ID.

​
Disconnecting

Disconnecting Island deletes its stored counts and its record of events already counted, so events delivered again after you reconnect are counted again. So does reconnecting to another tenant, switching between push and pull, or, for pull, changing the API URL or Audit ID.

​
Limitations

  • Only browsing inside the Island Enterprise Browser is covered. Desktop apps and command-line tools aren’t.
  • Only what your Island logging policy logs is covered.
  • No prompt or response content is available.

​
Troubleshooting

The key needs the Full Admin or System Admin role. Check that the environment variable where Openlayer runs holds the key, and restart Openlayer after you change it.
Island answered “not found”. Copy the Audit ID again from the Generic SIEM Integration settings. Also check the Island API URL: a host that doesn’t serve the SIEM API gives the same error. Then disconnect and connect again.
The tenant ID on the connection doesn’t match the tenant_id in Island’s events. Disconnect, and connect again with the right tenant ID.
Check that your Island logging policy logs navigation events for the users and sites you expect. For pull, remember there’s no backfill: only events after the API key was generated are available. For push, check that Island can reach the receiver URL.
Another SIEM may be reading the same Audit ID and acknowledging batches first. Give Openlayer its own Audit ID.