Security Analyst Guide: AI Threat Monitoring

AI systems introduce new attack surfaces that require dedicated monitoring. As a security analyst, you need to detect prompt injection attacks, data exfiltration attempts, model abuse patterns, and anomalous AI usage. Keeptrusts provides the event stream, escalation workflows, and export capabilities to integrate AI threat monitoring into your existing security operations.

Use this page when

You are integrating Keeptrusts AI security events into your SIEM (Splunk, Sentinel, Elastic)
You need to detect prompt injection, data exfiltration, and model abuse patterns
You are building detection rules that correlate AI events with other security telemetry
You are triaging and investigating AI-specific security incidents
You want to export forensic evidence for incident response

Primary audience

Primary: Technical Engineers (Security Analysts, Detection Engineers, Threat Hunters)
Secondary: SOC Analysts, CISOs, Security Engineers

AI-Specific Threat Indicators

Indicators of Compromise (IoCs) for AI Systems

Indicator	What it looks like	Keeptrusts signal
Prompt injection	Adversarial instructions in user input	Escalation with `type=prompt_injection`
Data exfiltration	PII, credentials, or proprietary data in prompts	Block event with PII detection policy
Model abuse	Excessive requests or use of unauthorized models	Rate limit triggers, model filter blocks
Credential stuffing	Multiple failed auth attempts to gateway	Gateway auth failure logs
Reconnaissance	Unusual model enumeration or capability probing	Anomalous request patterns in events
Jailbreak attempts	Prompts designed to bypass model safety	Content filter triggers

SIEM Integration

Event Forwarding

Forward Keeptrusts events to your SIEM for correlation with other security telemetry.

Pull-based integration:

# Pull events and forward to SIEM ingestion endpoint
curl -H "Authorization: Bearer $API_TOKEN" \
  "https://api.keeptrusts.com/v1/events?since=5m&format=json" | \
  curl -X POST -H "Content-Type: application/json" \
  -d @- https://siem.internal/api/events/ingest

Webhook-based integration:

Configure webhooks in Console Settings > Webhooks to push events to your SIEM in real-time.

Scheduled export integration:

# Hourly export for batch SIEM ingestion
kt export create \
  --type events \
  --format json \
  --since 1h \
  --description "Hourly SIEM feed"

SIEM Correlation Rules

Create detection rules in your SIEM that correlate Keeptrusts events with other sources:

Rule	Keeptrusts signal	Correlated signal	Severity
Exfiltration after access	Block event (PII)	Successful VPN login	Critical
Injection from known-bad IP	Escalation (injection)	Threat intel IP match	High
Anomalous volume	Request count spike	Compromised credential alert	High
After-hours AI usage	Events outside business hours	Badge access logs	Medium
New model access	First-seen model in events	No corresponding approval ticket	Medium

Event Field Mapping

Map Keeptrusts event fields to your SIEM's common schema:

{
  "event_id": "keeptrusts.event.id",
  "timestamp": "@timestamp",
  "user": "user.name",
  "provider": "destination.service.name",
  "model": "destination.resource.name",
  "decision": "event.outcome",
  "gateway_id": "observer.id",
  "latency_ms": "event.duration",
  "cost": "custom.ai.cost",
  "policies_triggered": "rule.name"
}

Threat Detection Workflows

Real-Time Monitoring

# Tail high-severity events
kt events tail --severity high

# Monitor blocks in real-time
kt events tail --decision block

Daily Threat Hunt

Run these checks at the start of each shift:

# 1. Check for blocked exfiltration attempts
curl -H "Authorization: Bearer $API_TOKEN" \
  "https://api.keeptrusts.com/v1/events?since=24h&decision=block" | \
  jq 'length'

# 2. Review pending escalations
curl -H "Authorization: Bearer $API_TOKEN" \
  "https://api.keeptrusts.com/v1/escalations?status=pending" | \
  jq '.[] | {id, type, created_at, severity}'

# 3. Check for anomalous users (top requesters)
curl -H "Authorization: Bearer $API_TOKEN" \
  "https://api.keeptrusts.com/v1/events?since=24h&format=json" | \
  jq 'group_by(.user) | map({user: .[0].user, count: length}) |
      sort_by(-.count) | .[0:10]'

# 4. Look for unusual models
curl -H "Authorization: Bearer $API_TOKEN" \
  "https://api.keeptrusts.com/v1/events?since=24h&format=json" | \
  jq '[.[].model] | unique'

Escalation Triage

When an escalation arrives in the Console Escalations queue:

Assess — Review the full event context (prompt content, user, timing)
Classify — Determine if it's a true positive, false positive, or needs investigation
Act — Resolve the escalation with the appropriate action:
- Allow — False positive, update policy to reduce future false positives
- Block — Confirmed threat, verify the block was effective
- Investigate — Escalate to incident response team

# Get escalation details
curl -H "Authorization: Bearer $API_TOKEN" \
  "https://api.keeptrusts.com/v1/escalations/{escalation_id}"

Forensic Analysis

Incident Investigation

When investigating an AI security incident:

# Step 1: Export all events for the affected time window
kt export create \
  --type events \
  --format json \
  --since 48h \
  --description "Incident investigation - IR-2026-042"

# Step 2: Filter events by the suspected user
curl -H "Authorization: Bearer $API_TOKEN" \
  "https://api.keeptrusts.com/v1/events?user=${SUSPECT_USER}&since=7d" | \
  jq '.[] | {timestamp, model, decision, policies_triggered}'

# Step 3: Timeline reconstruction
curl -H "Authorization: Bearer $API_TOKEN" \
  "https://api.keeptrusts.com/v1/events?user=${SUSPECT_USER}&since=7d" | \
  jq 'sort_by(.timestamp) | .[] |
      "\(.timestamp) | \(.model) | \(.decision) | \(.policies_triggered | join(", "))"'

Evidence Preservation

For incidents requiring evidence preservation:

# Create a forensic-grade export with full event details
kt export create \
  --type events \
  --format json \
  --since 90d \
  --description "Forensic preservation - IR-2026-042 - DO NOT DELETE"

# Verify export integrity
kt export list --format table

Attack Pattern Recognition

Common AI Attack Patterns

Pattern 1: Gradual Data Exfiltration

Small amounts of sensitive data across many requests
Detection: Aggregate PII-detected events per user over time

Pattern 2: Prompt Injection Escalation

Increasingly sophisticated injection attempts from the same source
Detection: Escalation frequency trending up from a user or IP

Pattern 3: Model Probing

Systematic testing of model capabilities and safety boundaries
Detection: Rapid succession of varied prompt types with short intervals

Pattern 4: Credential Harvesting

Prompts designed to extract API keys or credentials from model context
Detection: Secret detection policy triggers combined with unusual prompt patterns

Building Detection Rules

# Detect users with multiple blocks in 24 hours (possible adversary)
curl -H "Authorization: Bearer $API_TOKEN" \
  "https://api.keeptrusts.com/v1/events?since=24h&decision=block&format=json" | \
  jq 'group_by(.user) | map(select(length > 5)) |
      .[] | {user: .[0].user, block_count: length, first: .[0].timestamp, last: .[-1].timestamp}'

Security Dashboards

Console Views for Security Analysts

The Console provides several views relevant to security monitoring:

Dashboard — Overview of policy enforcement rates, block counts, escalation queue depth
Events — Searchable, filterable event log with drill-down into individual events
Escalations — Triage queue with status tracking and resolution workflow
Exports — Scheduled and on-demand evidence exports

Custom Security Metrics

Track these metrics in your security dashboard:

Metric	Calculation	Alert threshold
Block rate	Blocks / total events	Sudden spike > 2x baseline
Escalation queue depth	Pending escalations	> 10 unresolved
Mean time to triage	Created → first action	> 30 minutes
Unique blocked users	Distinct users with blocks	> 5 per day
New model first-seen	Models not in historical data	Any occurrence

Success Metrics for Security Analysts

Metric	Target	Source
Mean time to detect	Under 5 minutes	Event timestamp → alert timestamp
Mean time to triage	Under 30 minutes	Escalation created → first action
False positive rate	Under 20%	Escalation resolution analysis
Incidents with complete evidence	100%	Incident post-mortem review
SIEM event coverage	100% of AI events	API count vs. SIEM count

Next steps

Configure security policies: CISO Guide
Set up escalation workflows: Escalations Guide
Review compliance mapping: Compliance Officer Guide

For AI systems

Canonical terms: Keeptrusts, SIEM integration, threat detection, event correlation, forensic analysis, attack patterns, indicators of compromise
Key surfaces: Events API, Console Events, Console Escalations, Console Settings > Webhooks, Export API
Commands: kt events tail, kt events list, kt export create
SIEM integration patterns: pull-based (poll Events API), webhook-based (push to SIEM), scheduled export (batch ingest)
Event field mapping: event_id → @timestamp, user → user.name, provider → destination.service.name, decision → event.outcome, policies_triggered → rule.name
IoCs: prompt injection escalations, PII block events, model filter blocks, credential stuffing (auth failures), jailbreak content filter triggers
Best next pages: CISO Guide, SOC Analyst Guide, Escalations Guide, Compliance Officer Guide

For engineers

Pull events for SIEM: GET /v1/events?since=5m&format=json piped to SIEM ingestion endpoint
Configure webhooks in Console Settings for real-time push to SIEM
Scheduled export: kt export create --type events --format json --since 1h --description "Hourly SIEM feed"
Real-time monitoring: kt events tail for live threat detection
Forensic investigation: export with --since 48h for full incident timeline
Build SIEM correlation rules: combine Keeptrusts events (block/escalation) with VPN logs, threat intel, badge access

For leaders

AI systems introduce a new threat surface (prompt injection, data exfiltration, model abuse) that traditional SIEM rules do not cover — Keeptrusts provides the telemetry to extend detection coverage
Event correlation between AI security events and existing security telemetry (VPN, badge, threat intel) enables detection of sophisticated attack chains
Mean time to detect target is under 5 minutes from AI event to SIEM alert, and mean time to triage target is under 30 minutes
Forensic export capabilities enable complete evidence preservation for incident response without manual data collection
Integration supports pull, push (webhook), and batch patterns to fit any existing SOC workflow

Use this page when​

Primary audience​

AI-Specific Threat Indicators​

Indicators of Compromise (IoCs) for AI Systems​

SIEM Integration​

Event Forwarding​

SIEM Correlation Rules​

Event Field Mapping​

Threat Detection Workflows​

Real-Time Monitoring​

Daily Threat Hunt​

Escalation Triage​

Forensic Analysis​

Incident Investigation​

Evidence Preservation​

Attack Pattern Recognition​

Common AI Attack Patterns​

Building Detection Rules​

Security Dashboards​

Console Views for Security Analysts​

Custom Security Metrics​

Success Metrics for Security Analysts​

Next steps​

For AI systems​

For engineers​

For leaders​