The city SOC wants AI API anomalies visible alongside other security events. What defensive integration is appropriate?
Select an answer to reveal the explanation.
Short Explanation
If AI weirdness never shows up in the SIEM, the SOC is flying blind—pipe ATLAS-style signals into the same glass. Candy drawers aren’t detection engineering.
Full Explanation
For the city SOC to see AI API anomalies alongside other security events, the appropriate defensive integration is ingesting ATLAS-informed AI attack signals into the municipal SIEM. Generative and agentic systems produce distinctive telemetry—abnormal prompt patterns, tool-call spikes, jailbreak signatures, anomalous token burn, unusual retrieval fan-out—that will not surface if AI APIs log only to application dashboards. Mapping detections to ATLAS-style tactics and techniques gives analysts a shared language and correlation paths with endpoint, identity, and network alerts already in the SIEM. Integration turns isolated AI oddities into municipal detection engineering, enabling faster triage when a 311 or permitting API is abused in concert with credential misuse or data exfiltration. Lumbar pillows on SOC chairs, neon wall-clock bezels, and more candy in snack drawers fail conceptually: comfort amenities do not create detections, parsers, or correlation rules for AI API abuse. Facilities upgrades are not SIEM integration. Exam caveat: 'monitor the LLM vendor portal' alone is weaker than SIEM-integrated, framework-informed detections when the stem asks for visibility alongside other security events. Operational check: ship AI gateway and API logs to the SIEM, deploy initial ATLAS-aligned use cases (e.g., injection pattern bursts, tool anomalies), and verify analysts can open a correlated case that includes AI events next to identity alerts.