Article
Audit Record Integrity and Attribution Monitoring | Detection
insiderthreatmatrix.org
Quoted on this wiki
Every place a page here uses this source, in the order the words come in it.
Contributors: Nimer Kees, Yonatan Machluf, The ITM Team, “Audit record integrity and attribution monitoring treats the audit record itself as the monitored asset.” Implementation
Implementation “Monitor the audit logging pipeline for integrity gaps, including missing events, sequence-number breaks, timestamp inconsistencies, clock skew, delayed ingestion, dropped records, disabled collectors, altered retention settings, and logging configuration changes.” Test coverage by reconciling tool-call logs against downstream side effects. Compare recorded synthetic subject tool calls, function arguments, and request identifiers with application audit logs, database changes, file writes, messages sent, infrastructure changes, payment actions, and external requests. Alert on orphaned effects, where a downstream change exists without a corresponding logged synthetic subject action or tool call.
Monitor the audit logging pipeline for integrity gaps, including missing events, sequence-number breaks, timestamp inconsistencies, clock skew, delayed ingestion, dropped records, disabled collectors, altered retention settings, and logging configuration changes. Correlate logging health events with synthetic subject sessions, tool calls, non-human identity activity, and downstream system changes. “Test coverage by reconciling tool-call logs against downstream side effects.” Test attribution by correlating each synthetic subject action to a resolvable actor chain. The record should identify the synthetic subject, agent instance, non-human identity, session, bound human principal where applicable, originating request, tool used, and affected asset. Alert when an action has no resolvable principal, is recorded only under a shared service account, or appears only under a human identity without an agent-origin marker.
Monitor the audit logging pipeline for integrity gaps, including missing events, sequence-number breaks, timestamp inconsistencies, clock skew, delayed ingestion, dropped records, disabled collectors, altered retention settings, and logging configuration changes. Correlate logging health events with synthetic subject sessions, tool calls, non-human identity activity, and downstream system changes. “Alert on orphaned effects, where a downstream change exists without a corresponding logged synthetic subject action or tool call.” Test attribution by correlating each synthetic subject action to a resolvable actor chain. The record should identify the synthetic subject, agent instance, non-human identity, session, bound human principal where applicable, originating request, tool used, and affected asset. Alert when an action has no resolvable principal, is recorded only under a shared service account, or appears only under a human identity without an agent-origin marker.
Test coverage by reconciling tool-call logs against downstream side effects. Compare recorded synthetic subject tool calls, function arguments, and request identifiers with application audit logs, database changes, file writes, messages sent, infrastructure changes, payment actions, and external requests. Alert on orphaned effects, where a downstream change exists without a corresponding logged synthetic subject action or tool call. “Test attribution by correlating each synthetic subject action to a resolvable actor chain.” Test provenance at the content layer. Feature outputs, generated records, messages, summaries, recommendations, and edits should be traceable to a distinct model identity, model version, prompt version, session, and generation event. Alert when model-generated content is indistinguishable from human-authored content within the same record, or when generated content cannot be tied to a specific synthetic subject.