> ## Documentation Index > Fetch the complete documentation index at: https://docs.openlayer.com/llms.txt > Use this file to discover all available pages before exploring further. # Island Enterprise Browser discovery > Discover AI usage from Island Enterprise Browser audit events, read from Island's SIEM API or pushed by Island The Island connector reads **browser audit events** from the Island Enterprise Browser and counts visits to AI services. Each AI service then appears in your [Shadow AI discovery](https://docs.openlayer.com/integrations/shadow-ai-discovery.md) findings, counted in browser navigations, with blocked attempts counted separately. > [!NOTE] > > This page covers Shadow AI discovery. To import the AI conversations Island AI > Protect captures, see [Island AI Protect](https://docs.openlayer.com/integrations/island.md). The two > connect separately. > [!NOTE] > > The Island connector is turned on separately from Shadow AI discovery. If it > isn't in the **Connectors** dialog, [reach out to > us](mailto:support@openlayer.com) to turn it on. ## Choose pull or push | | Pull (recommended) | Push | | - | - | - | | How events arrive | Openlayer reads Island's SIEM Audit Logs API | Island sends events to a receiver URL on Openlayer | | Network | Outbound HTTPS from Openlayer. Nothing reaches it | Island must reach Openlayer over HTTPS | | Credential | An Island API key, in an environment variable | A secret you generate, which Island sends in a header | Both modes count events the same way and store the same data. ## What Openlayer reads * **Navigation events to AI tools.** An event's tool is matched by the host of its page (`top_level_url`), then by Island's app name (`saas_application_name`, matched exactly against the catalog), then by an AI web category for sites the catalog doesn't know. * **Blocked attempts.** An event whose verdict is a block counts as a blocked attempt, never as usage. * **The user's email.** A masked or missing email is counted as an unknown user. Openlayer never uses Island's user name or user ID instead. * **No content.** Island's audit events carry no prompts or responses, and screenshot references are ignored. Everything else is counted by reason on the connector card and discarded: logins, screen recordings, embedded frames, non-AI sites, and unrecognized verdicts. Events with no timestamp, from another Island tenant, older than 30 days, or more than an hour in the future are rejected. ## Prerequisites * Shadow AI discovery and the Island connector turned on for your deployment. * An Island admin with the **Full Admin** or **System Admin** role. * An Island logging policy that **logs navigation events** for the users and sites you want covered. Openlayer only sees what Island logs, and only inside the Island browser. * Someone who can set an environment variable where Openlayer runs. If Openlayer hosts your deployment, that's us. ## Set up pull **1. Generate an API key and copy the Audit ID** In the Island Management Console, go to **Modules → Platform Settings → System Settings → Integrations → SIEM**, and click **Setup** for the **Generic SIEM Integration**. * Click **Generate API Key**. Island shows the key only once, so copy it. * Copy the **Audit ID** shown for the SIEM connector. **Give Openlayer its own Audit ID.** The SIEM API is a queue, and acknowledging a batch removes it for every reader. If another SIEM reads the same Audit ID, the two would split the events between them. **2. Put the API key in an environment variable** Set the key in an environment variable where Openlayer runs, such as `ISLAND_API_KEY`, and restart Openlayer. If Openlayer hosts your deployment, coordinate with us to set it. The admin portal stores only the variable's name, never the key. **3. Connect Island** In the admin portal, go to **Shadow AI → Discovery**, click **Connect**, choose **Island**, and select **Pull**. Fill in: * **Island tenant ID**: your tenant's ID, as Island's events carry it in `tenant_id`. Every event is checked against it. * **Island API URL**: the host that serves Island's SIEM API for your tenant, such as `https://api.island.io`. It must be an `https` URL on `island.io`. * **SIEM Audit ID**: the Audit ID from the first step. * **API key env var**: the variable from the previous step. It defaults to `ISLAND_API_KEY`. Click **Connect**. Openlayer reads the queue once to check the settings, without acknowledging anything. If the key or Audit ID is wrong, the error says which. The first sync starts right away. ### How Openlayer reads * **It syncs every 5 minutes.** Click **Sync now** on the card to start one immediately. Only one sync runs at a time. * **It drains the queue in order.** Island hands out the oldest batch first. Each sync reads up to 20 batches, and keeps going while Island reports more queued, so a large backlog drains over a few syncs. * **It acknowledges a batch only after storing it.** If a sync is cut off, or an acknowledgement fails, the batch stays queued. Island hands it out again, and events already counted aren't counted again. * **It doesn't let one bad batch block the queue.** If a batch fails to store 3 times in a row, Openlayer acknowledges it without storing it so the queue keeps draining, and the card shows a warning. * **There's no backfill.** Island's queue starts when the API key is generated, so events from before that aren't available. ## Set up push Push needs Island to reach Openlayer over HTTPS, so your deployment must accept inbound traffic from Island. Island sends the receiver secret in a header. Openlayer doesn't accept it in the URL. **1. Generate a receiver secret** Generate a random secret of at least 24 characters, for example with `openssl rand -hex 32`. Set it in an environment variable where Openlayer runs, such as `ISLAND_WEBHOOK_SECRET`, and restart Openlayer. **2. Connect Island** In the admin portal, go to **Shadow AI → Discovery**, click **Connect**, choose **Island**, and select **Push**. Fill in the **Island tenant ID** and the **Receiver secret env var**, then click **Connect**. The card then shows the **Receiver URL**, `https:///v1/discovery/island/events`, and the **Auth header** Island must send: `Authorization: Bearer `. If Island can send a custom header but not `Authorization`, [contact us](mailto:support@openlayer.com) to use a different header name. **3. Add the receiver in Island** In the Island Management Console, go to **Modules → Platform Settings → System Settings → Integrations → SIEM**, and set up the **Generic SIEM Integration** with the receiver URL as its **Server URL** and the auth header. Run Island's connection check. Openlayer answers it, and the card shows **Connection check received**. ### How Openlayer handles a delivery * It accepts NDJSON, a JSON array, or a single JSON object, optionally gzipped, up to 10 MB compressed and 32 MB decoded. * It answers with a `2xx` only after the events are stored. A retried or replayed delivery is recognized, and its events are counted as duplicates rather than counted again. | Status | Meaning | | - | - | | `200` | Stored, or a connection check. Safe to retry. | | `400` | The body can't be decoded. | | `401` | The secret is wrong or missing. | | `404` | Island isn't connected, or the connector is turned off. | | `413` | The body is over the size limit. | | `503` | The secret's environment variable isn't set. Retry later. | ## How findings appear * Findings are counted in **browser navigations**: visits to an AI tool in the Island browser. A count isn't a prompt count. * Blocked attempts are reported separately and never count as usage. * Per-user figures come from the event's email. Openlayer stores per-minute counts by tool, host, user email, and whether the visit was allowed or blocked, for 30 days, plus the IDs of events it has already counted. It never stores raw events. ## The connector card Open **Connect** on the Discovery page to see the Island card. It shows: * Totals: AI browser events stored, duplicates, events that weren't AI usage, and rejected events. * **Pull**: what the last sync read, and a warning if a batch was skipped after 3 failed attempts. * **Push**: the receiver URL and auth header, why the last delivery dropped events, and how many deliveries arrived with a wrong or missing secret. * A warning when a batch or delivery was stored but some of its events were rejected, and an error when a whole delivery was lost, usually to a wrong tenant ID. ## Disconnecting Disconnecting Island deletes its stored counts and its record of events already counted, so events delivered again after you reconnect are counted again. So does reconnecting to another tenant, switching between push and pull, or, for pull, changing the API URL or Audit ID. ## Limitations * Only browsing inside the Island Enterprise Browser is covered. Desktop apps and command-line tools aren't. * Only what your Island logging policy logs is covered. * No prompt or response content is available. ## Troubleshooting > **Island rejected the API key** > > The key needs the **Full Admin** or **System Admin** role. Check that the > environment variable where Openlayer runs holds the key, and restart > Openlayer after you change it. > **Island doesn't recognize the Audit ID** > > Island answered "not found". Copy the Audit ID again from the Generic SIEM > Integration settings. Also check the **Island API URL**: a host that doesn't > serve the SIEM API gives the same error. Then disconnect and connect again. > **Events are rejected as coming from another tenant** > > The tenant ID on the connection doesn't match the `tenant_id` in Island's > events. Disconnect, and connect again with the right tenant ID. > **Connected, but no events arrive** > > Check that your Island logging policy logs navigation events for the users > and sites you expect. For pull, remember there's no backfill: only events > after the API key was generated are available. For push, check that Island > can reach the receiver URL. > **Fewer events than expected** > > Another SIEM may be reading the same Audit ID and acknowledging batches > first. Give Openlayer its own Audit ID. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.