A city operates a municipal LLM gateway. Which monitoring practice best fits security telemetry?

Defining SIEM use cases for anomalous token spikes on the municipal LLM gateway treats token-volume telemetry as security-relevant monitoring, not merely a finance metric. The correct practice works because sudden spikes can indicate credential abuse, automated scraping, prompt-injection campaigns, misconfigured clients, or insider misuse; SIEM correlation and alerting turn those volume signals into timed investigations. Treating token-volume spikes as cost data only, not a security signal, fails conceptually by siloing a dual-use signal—cost anomalies and security anomalies often share the same underlying spike. Disabling SIEM feeds from the gateway to cut down on alert noise fails as a monitoring anti-pattern that removes visibility precisely where centralized AI access concentrates risk. Reviewing gateway logs only after a public breach announcement fails by making detection reactive to external disclosure instead of internal telemetry. Exam caveat: not every spike is malicious—batch jobs and seasonal civic demand can raise volume—so use cases need baselines, allowlists for known jobs, and escalation paths rather than naive always-page thresholds. Operational check: forward gateway auth, token, and error telemetry to the SIEM, author detection rules for anomalous spikes by identity and client, tune against known batch windows, and exercise the playbook with a tabletop or controlled spike test.