WitnessAI Documentation
List
Start Here
Start Here
Analytics
Analytics
Conversations
Conversations
Users
Users
Alerts
Alerts
Policy
Policy
Administration
Administration
Apps & Resources
Apps & Resources
Release Notes
Release Notes
Administrator Guide
Administrator Guide
Network Security Integrations
WitnessAI works with your existing firewalls, secure web gateways (SWGs) and cloud proxies to steer AI traffic through the WitnessAI proxy, where policies and guardrails are applied. You keep your current enforcement point, and WitnessAI tells it which destinations to inspect and forward.
An administrator sets these up during onboarding. End users connect the same way they do today.
How it works
Each integration relies on two building blocks:
- AI domain lists. WitnessAI maintains the set of domains used by AI applications and publishes them as external dynamic lists (EDLs) your device subscribes to. Your device matches traffic to these lists and forwards or inspects it.
- The WitnessAI proxy. Matching traffic is sent to your tenant's WitnessAI proxy, which applies the configured policies and guardrails and inserts the signed-in user's identity so activity can be attributed in Conversations and analytics.
Most devices also receive the user's email address through an
X-Authenticated-User HTTP header so WitnessAI can attribute each prompt to a person.Note: Network device integrations were updated in WitnessAI v2.0. Devices configured for v1.5 continue to work without interruption, but need a minor update to enable some v2.0 features. See the individual integration guides for details, or contact your WitnessAI account team.
The WitnessAI lists
WitnessAI publishes three lists. Which ones a device subscribes to depends on the integration:
List | Contents | Typical use |
Forward list | The full set of AI domains that should be steered to the WitnessAI proxy. | Forwarding and SSL inspection rules. |
URL list | The domains used to generate AI-usage (shadow AI) visibility logs. | URL filtering / log-feed filters for discovery. |
Blocked list | Domains WitnessAI has marked as blocked. | Optional block rules on devices that support a separate block list. |
Each list is offered in the format your device expects (for example, a Palo Alto domain list, a Zscaler URL category feed, or a Netskope URL list). The integration guide for your device specifies the exact list, format, and subscription URL to use.
Supported integrations
In alphabetical order:
- Netskope Secure Web Gateway (SWG)
- Palo Alto Networks Next-Generation Firewall (NGFW)
- Prisma Access: DNS sinkhole
- Prisma Access: explicit proxy
- Zscaler Internet Access (ZIA)
- Zscaler Internet Access: using FQDN groups
- Zscaler OneAPI
Note: A streamlined Zscaler onboarding flow is also available as a beta. See Zscaler Internet Access (beta).
Made with Bullet