Skip to main content
Version: 6.1

AI Security: Incident Manager Integration

Overview​

The AI Security module automatically registers incidents in Incident Manager based on threat detection jobs grouped by OWASP Top 10 for LLM Applications category.

Incident Manager

Incident Creation​

Each incident contains:

  • a title with the OWASP category, rule name, and agent user and host context
  • a description of the matched rule and incident context
  • OWASP category and module tags for quick filtering
  • additional fields containing the match context: event time, agent, user, host, outcome, and reason; or service, request, model response, signature, and pattern
  • incident details with a ready-to-use investigation plan for the operator: administrator guidance, initial context collection, identification of key fields, legitimacy assessment, collection of additional context, and L2 escalation criteria

Incident Examples​

Agent Privilege Escalation Attempt (LLM05/08)​

The incident records failed agent actions and access denial messages.

LLM05/08 incident

Prompt Injection (LLM01)​

The incident records a prompt injection attempt in an incoming user request.

LLM01 incident

Sensitive Information Disclosure (LLM06)​

The incident records secrets, personal data, or web attack indicators disclosed in model requests and responses.

LLM06 incident

Request Context Length Limit Exceeded (LLM04)​

The incident records an abnormally long request sent to the model through a proxy gateway, which may indicate a resource exhaustion attack against the LLM service.

LLM04 incident

Dangerous Command in a Model Response (LLM07)​

The incident records a destructive, exfiltration, or privilege escalation command in a model response.

LLM07 incident