Blue team playbooks trigger when civic LLM outputs unexpectedly mention internal hostnames. What capability is that?
Select an answer to reveal the explanation.
Short Explanation
If the bot suddenly blurts internal hostnames, that's a siren for the IR playbook—not a PII redaction filter for council minutes. Those cues catch suspicious civic LLM outputs early, not hallucination benchmarks for planning drafts or engagement dashboards.
Full Explanation
Blue-team playbooks that trigger when civic LLM outputs unexpectedly mention internal hostnames implement IR detection cues for suspicious generative outputs in municipal assistants. Sudden appearance of internal FQDNs, private addresses, ticket-system IDs, or non-public share paths in resident-facing answers can signal prompt leakage, compromised context, overly broad retrieval, or successful probing. Encoding those patterns as playbook triggers converts passive log review into repeatable detection and response for generative channels. Analysts can then contain the assistant session, rotate exposed credentials if implicated, and review retrieval corpora—actions that classic perimeter alerts alone would miss. Privacy redaction filters for citizen PII in published council meeting minutes, hallucination benchmarks for factual accuracy in planning document drafts, or usage analytics dashboards for citizen engagement with service chatbots do not create detection logic for generative leakage. Exam distractors often substitute workplace culture tasks for detection capability; choose the option that defines IR cues on model output. Caveat: hostname detectors need allow-lists for publicly documented municipal hostnames to avoid alert fatigue, and they should correlate with retrieval and tool logs rather than fire on every partial string match. Operational check: seed a test transcript with a non-public internal hostname, verify the playbook fires with the expected severity, and confirm the runbook lists containment steps specific to the civic assistant.