# Copilot

The Copilot dashboard has four tabs: **Overview**, **Cost**, **Usage**, and **Users**. Every figure is derived from Copilot's own usage data over the time range and filters you've set.

Before the dashboard shows data, set up the integration — see [Connect Copilot CLI](https://coralogix.com/docs/integrations/ai-observability/copilot-cli/index.md).

## Overview

A snapshot of Copilot activity across your org — models in use, active users, interactions, total cost, total tokens, the most-used feature, your power user, the top IDE, and the top programming language.

## Cost

Built to answer one question: where is your Copilot spend going, and what's it buying you?

- **Net cost** and **Net cost over time** — spend for the period and how it trended day by day.

- **CLI tokens** and **CLI tokens over time** — token volume attributed to Copilot CLI usage.

- **Cost by SKU** — split of spend across Copilot products (agent, premium request, chat).

- **Input tokens** and **Output tokens** — totals for the period.

## Usage

- **Activity** — active users, CLI sessions, CLI active users, and cloud agent users.

- **Feature usage** — which Copilot features are driving usage (code completion, agent, chat panel modes).

- **Model distribution** — which models Copilot is routing to.

- **IDE usage** — where developers are running Copilot.

- **Code impact** — PRs created and merged, the share of Copilot suggestions developers applied, and the languages they applied them in.

## Users

Active users ranked by interactions, with tokens, CLI sessions, lines of code, and models per user. Select any row to drill into that user's session activity and code impact.

## Alert examples

Example alerts you can build on Copilot's metrics to catch cost, adoption, and governance issues early. Each one expands to show what it detects and the query to use.

Single user CLI token concentration

Alerts when one user accounts for more than 60% of total CLI prompt tokens — a sign that heavy automated CLI jobs from one developer are crowding out org capacity.

```promql
sum by (user_email) (
  increase(github_copilot_user_cli_prompt_tokens_sum[1h])
)
/ on() group_left() (
  sum(increase(github_copilot_user_cli_prompt_tokens_sum[1h])) + 1
)
```

Org-wide code acceptance rate drop

Alerts when accepted suggestions as a share of total generated suggestions drops below 20%. Developers are rejecting most of Copilot's output, which can signal prompt-quality or model-alignment issues.

```promql
sum(increase(github_copilot_org_code_acceptance_activity_count[24h]))
/ (sum(increase(github_copilot_org_code_generation_activity_count[24h])) + 1)
```

Zero daily active users

Alerts when no users are active for the current day — a sign of a complete outage, auth failure, or connectivity issue.

```promql
sum(github_copilot_org_daily_active_users{}) == 0
```

Unused licensed seats (wasted spend)

Alerts when billed seats exceed monthly active users by more than 20 (adjustable). Every unused seat is avoidable spend.

```promql
sum(github_copilot_billing_net_quantity)
- sum(github_copilot_org_monthly_active_users)
```

Billing net amount spike

Alerts when Copilot net billing increases more than 30% compared to 7 days ago — a sign of unexpected seat additions or SKU upgrades before the monthly invoice.

```promql
sum(github_copilot_billing_net_amount)
/ sum(github_copilot_billing_net_amount offset 7d)
```

New or unapproved model detected (7-day offset)

Alerts when a Copilot interaction is recorded against a model that wasn't present over the previous 7 days. The alert surfaces the exact model name so leadership can assess whether it's sanctioned and act accordingly.

```promql
count by (model) (
  github_copilot_user_user_initiated_interaction_count_by_model_feature
)
unless
count by (model) (
  github_copilot_user_user_initiated_interaction_count_by_model_feature offset 7d
)
```