Reskill · SOC

Security Operations

The incident room asks one question first: what did the agent do, and what did the user do?

Attribution is the skill. Until the record separates the two, every autonomous action is unowned.

Start with these skills

Protect audit logs from tamperinggate
Monitor and alert on AI-relevant eventsgate
Control who reads the logs, and log that toogate
Respond to what the logs say, on a clockgate
Keep clocks in sync so timelines holdgate

The rung you have to reach

Security Monitoring

Monitoring and logging of AI applications and activity, including prompts, input/output, service usage, agent actions, data access, and other relevant logs and events useful for security and compliance.

L1 · Initial

No AI-specific monitoring. Reliance on cloud and/or AI provider default logging, if enabled. No visibility into prompts, agent actions, or AI service usage. AI activity untracked and unauditable.

L2 · Repeatable

Basic AI service logs collected (model invocations, API calls) and initial token/cost tracking for major AI platforms. Logs retained in the provider but not regularly analyzed for security. No prompt or response capture. AI usage logs reviewed for billing or troubleshooting but not security.

L3 · Defined

Prompt/response logging implemented for key AI applications (with appropriate data handling/masking). Agent action logging captures tool calls and resource access. Initial AI-specific alerting (e.g., guardrail violations, information disclosure). Logs aggregated into central SIEM. MCP and tool invocations logged.

L4 · Capable

Comprehensive AI telemetry across applications, including prompts, responses, agent actions, delegation chains, and data access. AI-specific threat detection in place (prompt injection, jailbreak attempts, anomalous patterns). Delegation chain auditability for multi-agent workflows. Alerts integrated with SOC workflows. Sensitive data detection in key AI inputs/outputs.

L5 · Efficient

Real-time AI security monitoring with automated response capabilities. Full auditability from user intent through agent actions to resource access. AI behavioral baselines with anomaly detection. Proactive threat hunting for AI attack patterns. AI monitoring integrated with incident response playbooks.

This function also touches: AI Supported Development and Supply Chain Security, Incident Response.

our model · calibrated to SAE J3016

Your syllabus

The plays that climb the rung.

Alert triage & enrichment

Disposition the alert queue: enrich each alert with context, close false positives, escalate what matters.

Moves: Time per alert ↓