City IR KSAs are updated so analysts can tell extraction campaigns from normal civic API load. What capability is being built?

Updating city IR KSAs so analysts can tell extraction campaigns from normal civic API load builds incident-response skills to recognize model-extraction patterns against municipal AI APIs. Detection without trained responders stalls; analysts need criteria for anomalous volume, query diversity, pacing, and account behavior so they can escalate, throttle, and investigate appropriately during on-call rotations.

Expertise in model poisoning and fine-tuning attacks is valuable knowledge, but it's the wrong capability for telling extraction campaigns apart from normal load—poisoning concerns training-time integrity, not query-time abuse. General intrusion-detection skills for volumetric spikes in civic network flows will catch obvious floods but miss model-extraction campaigns that use steady, low-volume queries mimicking ordinary authenticated API usage. Incident-response skills to investigate data exfiltration through civic database audit logs target a different breach channel and are not the analytical skill needed to distinguish model-extraction queries from normal civic API load. The KSA being built is specifically about reading civic API traffic well enough to tell a vacuuming pattern from a busy afternoon.

Exam caveat: KSAs must map to concrete playbook steps and tools; training slides alone do not create capability. False positives from legitimate batch traffic should be covered in training so analysts do not ignore or disable alerts.

Operational check: add extraction-pattern modules to IR training, run tabletop or purple-team drills against municipal AI APIs, and verify on-call staff can correctly classify and respond to simulated extraction traffic with documented outcomes. Capture drill scores in the IR training record so leadership can see whether extraction recognition KSAs are actually current.