Skip to content

Agentic SOC Detection Pack

What this adds. SecurityRecipes now turns the secure context layer into SOC-operable signal. The pack gives detection engineers a starting set of MCP and agentic AI alerts tied to run receipts, telemetry contracts, policy decisions, incident response, and replay evidence.

Enterprise AI security will not be trusted if the only evidence lives in chat transcripts or one-off audit documents. Agentic systems need the same operational muscle as cloud and endpoint security: normalized events, tuned detections, escalation decisions, replay validation, and alert evidence that a SOC can route into existing workflows.

The Agentic SOC Detection Pack makes that concrete. It packages metadata-only detection rules for token passthrough, tool-surface drift, context poisoning, unsafe telemetry, approval bypass, browser-agent egress, runaway loops, shadow MCP servers, stale standards, and red-team replay regressions.

Generated artifact

  • Profile: data/assurance/agentic-soc-detection-profile.json
  • Generator: scripts/generate_agentic_soc_detection_pack.py
  • Runtime evaluator: scripts/evaluate_agentic_soc_detection_event.py
  • Evidence pack: data/evidence/agentic-soc-detection-pack.json
  • MCP tools: recipes_agentic_soc_detection_pack and recipes_evaluate_agentic_soc_detection_event

Regenerate and validate:

python3 scripts/generate_agentic_soc_detection_pack.py
python3 scripts/generate_agentic_soc_detection_pack.py --check

Evaluate one event:

python3 scripts/evaluate_agentic_soc_detection_event.py \
  --workflow-id vulnerable-dependency-remediation \
  --event-class mcp.tools.call \
  --attribute service.name=security-recipes-mcp \
  --attribute deployment.environment=production \
  --attribute trace_id=trace-ci \
  --attribute span_id=span-ci \
  --attribute workflow_id=vulnerable-dependency-remediation \
  --attribute run_id=run-ci \
  --attribute agent_id=sr-agent::vuln-deps::codex \
  --attribute identity_id=sr-agent::vuln-deps::codex \
  --attribute tenant_id=tenant-ci \
  --attribute correlation_id=ci-correlation \
  --attribute receipt_id=sr-run-receipt::vulnerable-dependency-remediation \
  --attribute telemetry.redaction_state=metadata_only \
  --attribute authorization.token_passthrough_detected=true \
  --attribute authorization.decision=deny_token_passthrough \
  --expect-decision soc_critical_kill_session

Detection rules

RuleSOC decisionWhy it matters
MCP token passthrough or audience mismatchsoc_critical_kill_sessionStops confused-deputy and token-forwarding failures before an MCP server becomes an exfiltration proxy.
Critical MCP tool surface driftsoc_high_escalateCatches changed tool descriptions, schemas, or fingerprints before agents trust a poisoned capability.
Context poisoning reached retrievalsoc_critical_kill_sessionTreats retrieved prompt injection as an operational incident, not a model-quality issue.
Secret or cross-tenant telemetrysoc_critical_kill_sessionPrevents observability systems from becoming a prompt, token, or tenant-data sink.
High-impact action without approval receiptsoc_high_escalateMakes excessive agency visible to the SOC when approval evidence is missing, expired, or bypassed.
Browser agent URL or form exfiltrationsoc_high_escalateDetects agentic browser flows that send sensitive context through URLs, forms, or external destinations.
Unbounded agent loop or cost runawaysoc_medium_investigateConverts denial-of-wallet and runaway planning loops into measurable budget alerts.
Shadow MCP server or unknown connectorsoc_high_escalateFlags unregistered servers before a local or remote MCP connector gains trust by convenience.
Source freshness or standard driftsoc_medium_investigateKeeps rules tied to current MCP, OWASP, NIST, and frontier-lab guidance instead of stale assumptions.
Red-team replay regressionsoc_high_escalateBlocks releases and connector promotions when known adversarial fixtures start passing unexpectedly.

Enterprise default

The default alert path is metadata-first. The pack expects workflow id, run id, agent id, identity id, tenant id, trace id, span id, correlation id, receipt id, policy decision, and redaction state. Raw prompts, model outputs, tool arguments, tool results, HTTP bodies, and retrieved context snippets are not required for initial SOC detection.

That choice matters for regulated buyers. A detection pack that requires full transcripts will be blocked by privacy, legal, and customer-data review. A pack built on hashes, decisions, receipts, and trace links can ship into production sooner.

SIEM export shape

The generated pack includes starter query templates for:

  • Splunk SPL
  • Microsoft Sentinel KQL
  • Google Security Operations / Chronicle YARA-L-style predicates

These are intentionally fielded templates, not turnkey customer rules. Production deployments still map collector fields, severity routing, suppression windows, ownership, ticket enrichment, and retention to the tenant environment.

Source anchors

See also