A Security Field Guide to AI Audit Trails: What Enterprise AI Tools Log, What They Miss, and How to Detect, Hunt, and Investigate With It

AI agents now read and write code, run commands, search business data, and act through connected systems. When one does something unexpected, can your security team reconstruct what happened?

Every major AI tool emits security-relevant records, but what gets logged varies by product, plan, and configuration. The hard part is knowing where those records live, what they capture, which identifiers matter, and what never shows up.

A Security Field Guide to AI Audit Trails maps those sources tool by tool, with sample records from each. It shows how to put them to work across detection, threat hunting, incident response, governance, and AI asset inventory, and where you'll need endpoint, identity, network, Git, and application evidence to fill the gaps.

Sources covered

• Claude Code and Claude Cowork OpenTelemetry
• OpenAI Codex OpenTelemetry
• Cursor audit and runtime telemetry
• GitHub Copilot audit and session visibility
• Anthropic Compliance Activity Feed
• OpenAI API Platform audit logs
• Google Workspace Gemini activity logs

What you'll learn

• What each tool logs, by product and surface
• The fields and identifiers that matter
• Collection, retention, licensing, privacy, and API quirks
• Security use cases, evidence limits, and supporting sources

Written for detection engineers, SOC analysts, threat hunters, incident responders, and the security leaders who set logging policy. This second edition reflects how these tools and their logs have changed since the first.