A county detection strategy aims to catch extraction-like activity against civic embedding and completion APIs. What signal should analysts prioritize?

To catch extraction-like activity against civic embedding and completion APIs, analysts should prioritize anomalous high-volume or systematically varied query patterns inconsistent with normal civic use. Extraction often looks like dense sampling, combinatorial probing, or methodical coverage of the input space rather than the sparse, task-driven queries typical of residents and staff working through ordinary municipal workflows.

Login timestamps and geographic patterns catch account-level abuse but miss extraction carried out through a single legitimate-looking account making many systematically varied queries, so they can't serve as the primary detection signal. Steady growth in aggregate token consumption simply reflects broader civic platform adoption rather than anomalous querying, so it is not a reliable primary detection signal for extraction. Regular rotation cycles for API credentials are a compliance and hygiene control, not a detection signal; they don't reveal extraction-like query patterns against civic APIs. The signal that actually distinguishes extraction is the volume and systematic variation of the queries themselves against a civic-use baseline.

Exam caveat: high volume alone can be legitimate (batch jobs, outages, seasonal campaigns); combine volume with diversity, pacing, and account context, and tune thresholds to reduce false positives that distract municipal SOCs from real extraction attempts.

Operational check: baseline per-client and per-endpoint query rates and diversity for embedding and completion APIs, alert on sustained anomalous patterns, and tie alerts to playbooks that can throttle, investigate, and escalate extraction-like campaigns with clear ownership.