Skip to main content

G-12 Security monitoring

Brick G of the Enterprise AI Platform. Technology: Wazuh (agents, rules, FIM) + client SIEM forwarding (syslog/CEF, OpenSearch, Splunk HEC). French version: ../../fr/bricks/G-12-security-monitoring.md.

Role and responsibilities​

  • Detect intrusion, file integrity changes, suspicious API usage (key abuse, denied bursts, prompt injection bursts).
  • Forward audit and security events to the client SIEM.

Position and interactions​

  • Execution path: event stream.
  • Wazuh decoders for eai audit JSON; high severity rules call POST /v1/incidents.

Open source and developed parts​

  • Open source reused: Wazuh manager, indexer, agents.
  • Developed in the platform: Decoders and rules for AI specific threats, SIEM export mapping.

Data model​

Control Plane tables (schema eai): eai.audit_events.

Every tenant table has tenant_id uuid NOT NULL and a row level security policy on current_setting('app.tenant_id', true)::uuid. ClickHouse usage_events is the analytics replica of eai.usage_events (ReplacingMergeTree keyed by event_id).

Contract: contracts/v1/audit-event.schema.json (schema_version 1.0). Usage is always reported with contracts/v1/usage-event.schema.json, audit with contracts/v1/audit-event.schema.json.

API endpoints​

MethodPath
GET/v1/audit/events
POST/v1/incidents

GET /v1/audit/events​

Response:

{
  "items": [
    {
      "event_id": "aud_901",
      "sequence": 90311,
      "action": "model.invoke",
      "decision": "allow",
      "outcome": "success",
      "hash": "9c1e..."
    }
  ],
  "next_cursor": "c_2"
}

POST /v1/incidents​

Request:

{
  "title": "Prompt injection burst on agt_support",
  "severity": "high",
  "category": "security",
  "description": "Wazuh rule 100210: prompt injection burst on agt_support.",
  "resources": [
    {
      "type": "agent",
      "id": "agt_support"
    }
  ]
}

Response:

{
  "id": "inc_8",
  "status": "open"
}

SDK examples​

Python​

from enterprise_ai import EnterpriseAI

client = EnterpriseAI(base_url="<control-plane-url>", api_key="eai_live_xxx", tenant="acme", locale="en")
client.audit.events(action="model.invoke", since="2026-10-01T00:00:00Z")
client.incidents.create(title="Prompt injection burst", severity="high")

TypeScript​

import { EnterpriseAI } from "@enterprise-ai/sdk";

const client = new EnterpriseAI({ baseUrl: "<control-plane-url>", apiKey: process.env.EAI_API_KEY, tenant: "acme", locale: "en" });
await client.audit.list({ action: "model.invoke", from: "2026-10-01T00:00:00Z" });
await client.incidents.create({ title: "Prompt injection burst", severity: "high" });

Java​

EnterpriseAIClient client = EnterpriseAIClient.builder()
    .baseUrl("<control-plane-url>")
    .apiKey(System.getenv("EAI_API_KEY"))
    .tenant("acme")
    .locale(Locale.ENGLISH)
    .build();
client.audit().events(Map.of("action", "model.invoke", "from", "2026-10-01T00:00:00Z"));
client.incidents().create(Map.of("title", "Prompt injection burst", "severity", "high"));

Go​

client, err := eai.NewClient(eai.WithBaseURL("<control-plane-url>"), eai.WithAPIKey(os.Getenv("EAI_API_KEY")), eai.WithTenant("acme"), eai.WithLocale("en"))
if err != nil { log.Fatal(err) }
ctx := context.Background()
_, err = client.Audit.Events(ctx, eai.WithQuery(map[string]string{"action": "model.invoke", "from": "2026-10-01T00:00:00Z"}))
_, err = client.Incidents.Create(ctx, map[string]any{"title": "Prompt injection burst", "severity": "high"})

Configuration​

Environment variables: EAI_SIEM_WEBHOOK_URL.

Helm values keys (deploy/helm/enterprise-ai/values.yaml): global.monitoring.siem.

Security​

  • Forwarding over TLS with client certificates.
  • Tenant resolved from the credential, never from the body; PostgreSQL row level security on every tenant table.
  • Every mutation and policy decision writes a hash chained audit event (G-11).
  • Errors use the standard envelope with message_i18n en and fr.

Observability​

  • Event per second and rule hit dashboards.
  • W3C traceparent propagated, X-Request-Id returned, spans carry eai.tenant_id, eai.project, eai.agent_id, eai.run_id.

FinOps units​

  • Indexer storage allocated as security cost.

Failure modes and resilience​

  • SIEM unreachable -> local spool with bounded size and alert.

Standalone adoption​

Clients with an existing SIEM only consume the forwarded stream.

Acceptance tests​

  1. 20 policy_denied in 1 minute for one key raise a Wazuh alert and an incident.

Implementation roadmap