AID-D-005: AI Activity Logging, Monitoring & Threat Hunting
Establish auditable AI security telemetry and use it for monitoring, alerting, investigation, and hypothesis-driven threat hunting. Cover the relevant request, response, identity, model, agent, tool, data-access, cost, infrastructure, and error events without treating hidden reasoning or raw sensitive content as ordinary log data.
Scope boundary
Owns the logging, rule-delivery, monitoring, investigation, hunting, triage, sensor-health, and volatile-evidence functions built on AI security telemetry. Logging an event does not by itself prove that a specialized detector identified the associated threat.
Sub-techniques
- AID-D-005.001: AI System Log Generation & Collection
- AID-D-005.002: AI Detection Rule Lifecycle, Delivery & Health
- AID-D-005.003: Proactive AI Threat Hunting
- AID-D-005.004: Specialized Agent & Session Logging
- AID-D-005.005: Accelerator Telemetry Anomaly Detection
- AID-D-005.006: Agent Registry & Resolution Telemetry Monitoring
- AID-D-005.007: Token, Tool-Use, Request-Parameter & Cost Spike Detection & Alerting
- AID-D-005.008: Read-only Agentic Alert Triage
- AID-D-005.009: AI-Service C2 & Abuse-Channel Detection
- AID-D-005.010: Telemetry Pipeline Health & Sensor-Loss Detection
- AID-D-005.011: Incident-Time AI Volatile-State Capture & Evidence Preservation
Threat mappings
MITRE ATLAS
- AML.T0024.002 Exfiltration via AI Inference API: Extract AI Model
- AML.T0025 Exfiltration via Cyber Means
- AML.T0029 Denial of AI Service
- AML.T0034 Cost Harvesting
- AML.T0034.000 Cost Harvesting: Excessive Queries
- AML.T0034.001 Cost Harvesting: Resource-Intensive Queries
- AML.T0034.002 Cost Harvesting: Agentic Resource Consumption
- AML.T0040 AI Model Inference API Access
- AML.T0053 AI Agent Tool Invocation
- AML.T0057 LLM Data Leakage
- AML.T0072 Cyber Communication Channel
- AML.T0073 Impersonation
- AML.T0080 AI Agent Context Poisoning
- AML.T0080.000 AI Agent Context Poisoning: Memory
- AML.T0080.001 AI Agent Context Poisoning: Thread
- AML.T0081 Modify AI Agent Configuration
- AML.T0085 Data from AI Services
- AML.T0085.001 Data from AI Services: AI Agent Tools
- AML.T0086 Exfiltration via AI Agent Tool Invocation
- AML.T0096 AI Service API
- AML.T0107 Exploitation for Defense Evasion
- AML.T0108 AI Agent
- AML.T0114 AI Service Web Interface
- AML.T0125 Create Account
- AML.T0126 Automated Collection
- AML.T0130 AI Agent Response Biasing
- AML.T0131 Crafted AI Assistant Links
MAESTRO
- Model Stealing (L1)
- Denial of Service (DoS) Attacks (L1)
- Data Exfiltration (L2)
- Denial of Service on Framework APIs (L3)
- Denial of Service (DoS) Attacks (L4)
- Resource Hijacking (L4)
- Compromised Observability Tools (L5)
- Evasion of Detection (L5)
- Poisoning Observability Data (L5)
- Regulatory Non-Compliance by AI Security Agents (L6)
- Agent Impersonation (L7)
- Agent Tool Misuse (L7)
- Agent Goal Manipulation (L7)
- Integration Risks (L7)
- Repudiation (L7)
- Compromised Agent Registry (L7)
- Malicious Agent Discovery (L7)
OWASP LLM Top 10 2026
- LLM01:2026 Prompt Injection
- LLM02:2026 Sensitive Information Disclosure
- LLM03:2026 Excessive Agency
- LLM05:2026 Data and Model Poisoning
- LLM06:2026 Unbounded Consumption
OWASP ML Top 10 2023
- ML05:2023 Model Theft
OWASP Top 10 for Agentic Applications 2026
- ASI01:2026 Agent Goal Hijack
- ASI02:2026 Tool Misuse and Exploitation
- ASI03:2026 Identity and Privilege Abuse
- ASI04:2026 Agentic Supply Chain Vulnerabilities
- ASI06:2026 Memory & Context Poisoning
- ASI07:2026 Insecure Inter-Agent Communication
- ASI08:2026 Cascading Failures
- ASI10:2026 Rogue Agents
NIST Adversarial Machine Learning 2025
- NISTAML.014 Energy-latency
- NISTAML.031 Model Extraction
- NISTAML.036 Leaking information from user interactions
- NISTAML.038 Data Extraction
- NISTAML.039 Compromising connected resources
Cisco Integrated AI Security and Safety Framework
- AITech-1.2 Indirect Prompt Injection
- AITech-2.1 Excessive Agency
- AITech-3.1 Masquerading / Obfuscation / Impersonation
- AITech-4.1 Agent Injection
- AITech-8.2 Data Exfiltration / Exposure
- AITech-9.2 Detection Evasion
- AITech-10.1 Model Extraction
- AITech-12.1 Tool Exploitation
- AITech-13.1 Disruption of Availability
- AITech-13.2 Cost Harvesting / Repurposing
- AITech-16.1 Eavesdropping
- AITech-18.2 Malicious Workflows
- AISubtech-2.1.1 Execution Approval Bypass
- AISubtech-2.1.2 Capability and Permission Overreach
- AISubtech-3.1.1 Identity Obfuscation
- AISubtech-4.1.1 Rogue Agent Introduction
- AISubtech-10.1.1 API Query Stealing
- AISubtech-12.1.1 Parameter Manipulation
- AISubtech-13.1.1 Compute Exhaustion
- AISubtech-13.1.2 Memory Flooding
- AISubtech-13.1.3 Model Denial of Service
- AISubtech-13.1.4 Application Denial of Service
- AISubtech-13.2.1 Service Misuse for Cost Inflation
- AISubtech-16.1.1 Logging Sensitive Conversations
Google Secure AI Framework 2.0 - Risks
- DMS: Denial of ML Service
- MRE: Model Reverse Engineering
- IIC: Insecure Integrated Component
- PIJ: Prompt Injection
- SDD: Sensitive Data Disclosure
- RA: Rogue Actions
Databricks AI Security Framework 3.0
- Raw Data 1.10: Lack of data access logs
- Model Serving - Inference requests 9.7: Denial of Service (DoS)
- Model Serving - Inference requests 9.11: Model Inference API Access
- Model Serving - Inference response 10.1: Lack of audit and monitoring inference quality
- Platform 12.3: Lack of incident response
- Agents - Core 13.1: Memory Poisoning
- Agents - Core 13.2: Tool Misuse
- Agents - Core 13.3: Privilege Compromise
- Agents - Core 13.4: Resource Overload
- Agents - Core 13.8: Repudiation & Untraceability
- Agents - Core 13.9: Identity Spoofing & Impersonation
- Agents - Core 13.13: Rogue Agents in Multi-Agent Systems