Managing agent analytics settings
You can use the Analytics settings page to control how trace‑level analytics are collected and protected for your tenant. These settings help ensure that sensitive data is handled securely while still allowing your team to gain insights into agent activity and performance.
This feature is not supported in On-premises deployment.
Before you begin
Only users with the Admin role can configure analytics settings. Admins can enable or modify PII masking and other analytics‑related configuration options for the tenant.
Configuring Agent analytics
The Analytics section under Settings helps you to manage how analytic data is captured in trace metadata. You can enable masking options that help prevent personally identifiable information (PII) from appearing in dashboards, logs, or exported data.
PII masking
PII masking helps protect potentially sensitive information by masking detected PII attributes in future traces. Masking applies only to new data. The existing logs remain unchanged.
When masking is enabled, user inputs and agent outputs remain visible, but detected PII elements such as email addresses and phone numbers are masked before they appear in reports or logs.
Previously generated logs remain intact. Only traces created after masking is enabled are masked.
Enabling PII masking
From the profile icon, click Settings.
Select the Analytics tab.
Locate the PII masking option.
Toggle the control to On.
Review the confirmation dialog that explains how masking affects trace visibility.
Click Confirm to enable masking.
After confirmation, PII masking is applied to all future traces.
Selecting a masking method
After masking is enabled, choose the masking method that best aligns with your data‑handling requirements.
Selective PII masking (recommended)
Selective masking automatically identifies and masks common types of PII while keeping the rest of the trace content visible. This option is suitable when you want to maintain analytics visibility but still ensure that identifiable attributes are protected.
Selective masking:
Automatically masks built‑in PII types (for example, emails, phone numbers, and credit card numbers)
Keeps broader context available for debugging and performance insights
Ensures sensitive attributes are redacted while leaving non‑PII content visible
For reference, you can review additional regular expressions used for identifying structured PII patterns, see PII regular expression patterns for more details.
Example masked output:
"email": "*****@******.com"
"phone": "**********"Full redaction
Full redaction removes all user input and agent output content from traces. Use this option in high‑security environments where no conversational content should be visible.
When full redaction is enabled, draft evaluation is disabled. The test experience depends on trace data, and without accessible trace details, watsonx Orchestrate cannot reliably run evaluation tests.
Live monitoring metrics are also impacted, especially those related to answer quality and tool quality.
Full redaction:
Protects all user and agent text
Provides maximum data privacy
May limit monitoring, evaluation, and troubleshooting capabilities
Example fully redacted output:
"user_input": "[Redacted]"
"agent_output": "[Redacted]"After configuring analytics settings, you can return to the Analytics tab at any time to adjust masking behavior or switch between masking modes based on evolving privacy requirements.
PII regular expression patterns
The following table lists regular expressions commonly used to identify structured PII formats. These patterns help identify structured sensitive data types such as emails, dates, postal addresses, and financial identifiers.
Type | Regular expression pattern | Matching example | Non matching example | |||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
\b | abcd@test.com john.doe@gmail.com user_123@company.org test.email+promo@sub.domain.net a_b+c%1@my-domain.co x@abc.in | abcdattestdotcom abcd@test abcd@.com @test.com abcd@domain abcd@test..com abcd@@test.com | ||||||||||||||||||||||||||||||||||||||||
Date | \b(?!666\ | 000\ | 9\d{2})\d{3}-(?!00)\d{2}-(?!0{4})\d{4}\b | 01/02/2024 1/2/24 12-11-2023 9/8/99 31/12/2025 2024/01/15 2023-12-05 1999/9/8 2025-10-3 1 Jan 2024 15 Feb, 2023 9 Aug 1999 31 Dec, 2025 July 5 2026 | 2024.01.15 01-02 32/01/2024 01/13/2024 Jan 1 2024 20240115 15/08 | |||||||||||||||||||||||||||||||||||||
SSN | \b(?!666\ | 000\ | 9\d{2})\d{3}-(?!00)\d{2}-(?!0{4})\d{4}\b | 123-45-6789 001-12-3456 665-99-9999 | Invalid area numbers: 000-12-3456 666-45-6789 900-12-3456 987-65-4321 Invalid group or serial numbers:123-00-6789 123-45-0000 Invalid format:123456789 123 45 6789 12-345-6789 | |||||||||||||||||||||||||||||||||||||
Credit card | \b(?:\d{4}[-\s]?){3}\d{4}\b | 4111-111111-11111 378282246310005 6011 0009 9013 9424 123 4222222222222 4111 1111 1111 1111 4111111111111111 | 1234-5678-9012 4111-1111-1111 123456789012 abcd-efgh-ijkl-mnop 4111_1111_1111_1111 | |||||||||||||||||||||||||||||||||||||||
Phone | (?:\+?(\d{1,3}))?(?:[-.\s]?\(?\d{1,4}\)?)?(?:[-.\s]+\d{2,5}){2,}\b | 123-456-7890 (123) 456-7890 123.456.7890 123 456 7890 +1 123-456-7890 +91 98765 43210 +44 20 7946 0958 0049 30 901820 +1 (234) 56 78 90 +81-3-1234-5678 | 1234567 123-45-678 phone123456 +1-23-456 (123)45 | |||||||||||||||||||||||||||||||||||||||
IP Address (IPV4) | \b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b | 192.168.1.1 10.0.0.1 127.0.0.1 8.8.8.8 255.255.255.255 1.2.3.4 | 192.168.1 192.168.1.1.1 192.168.1. abc.def.ghi.jkl 192.168.one.1 2001:0db8:85a3::8a2e:0370:7334 | |||||||||||||||||||||||||||||||||||||||
Postal Address | \b(\d{1,5})\s([a-zA-Z0-9\s]+)\s,?\s([a-zA-Z\s]+)\s,?\s([A-Z]{2})\s*(\d{5}(-\d{4})?)\b | 123 Main Street, Springfield, IL 62704 4567 Elm Rd Apt 5, Dallas, TX 75201 9 Broadway, New York, NY 10001 789 Market Street San Francisco CA 94103 1010 Pine Ave, Seattle, WA 98101-1234 | Main Street, Springfield, IL 62704 123 Main Street, Springfield, Illinois 62704 123 Main Street, Springfield, IL 123, Springfield, IL 62704 123 Main Street, Springfield, il 62704 123 Main Street, Springfield, IL 6270 | |||||||||||||||||||||||||||||||||||||||
Health Insurance | (?i)\b(?:\d{9}\ | [A-Za-z]\d{8}\ | \d{3}-\d{2}-\d{4}[A-Za-z]?\ | [A-Za-z]{3}\d{6,9})\b | 123456789 A12345678 z87654321 M00001234 123-45-6789 123-45-6789A 987-65-4321b ABC123456 xyz987654 IDN1234567 PAS123456789 | 12345678 A1234567 AB123456 1234-56-789 123-456-789 ABCD123456 123-45-678 | ||||||||||||||||||||||||||||||||||||
Salary Pattern | (?i)(?<![\d.,])(?:(?:[$£€₹]\ | usd\ | gbp\ | eur\ | inr)\s\d+(?:[.,]\d+)(?:\s*(?:k\ | grand\ | g\ | m\ | million\ | lakh\ | lac\ | crore\ | lpa\ | /\ | per\s*)(?:hr\ | hour\ | mo\ | month\ | yr\ | year\ | annum\ | annually\ | a\syear))?\ | \b\d+(?:[.,]\d+)\s(?:k\ | grand\ | million\ | lakh\ | lac\ | crore\ | lpa\ | /\ | per\s*)(?:hr\ | hour\ | mo\ | month\ | yr\ | year\ | annum\ | annually\ | a\syear)\b)(?![0-9]) | $ 50,000 $1000 €5.5m 12 Lakh 5 Crore 2.5 million 15 LPA 500/hr 10k per month EUR 2000 USD 50k 10k/year 20 grand | Thirty thousand 50000 100.50 12 5 Yearly 2026 |
The redaction logic used in Agent analytics is based on regex substring matching. The masking engine scans the input and replaces only the text segment that matches the configured pattern, without validating whether the entire string is a semantically correct PII value. For example, in the value 698.187.1.1.1, the substring 698.187.1.1 matches the IPv4 regular expression and is redacted, resulting in [REDACTED].1. This behavior is expected because the system performs partial, pattern-level substitution rather than full‑string validation. Documenting this behavior is recommended, especially when reviewing trace output for analytics or debugging purposes.