Capture
Record material events outside the agent's write authority.
From harness activity
to accountable response.
Watch each component emit its own evidence. Follow the trace into an Elastic security pipeline, then separate a baseline observation, a deviation signal and an evidence gap.
SIMULATION ONLYGenerated locally in this browser. No enterprise connection, no real alerts, no credentials, no data sent to Elastic or HoundBytes. The moving signals illustrate the architecture; they do not implement it.
Simulation controls become available when JavaScript runs.
CONTROL / HB-AI-600 / COMPONENT 1 OF 19
Within fixture baseline / simulated6.00 Generative model
On a narrow screen, swipe the diagram horizontally or focus it and use the arrow keys. The event and producer details remain below.
Operational observationsIndependent control evidenceIllustrative flow · not live transport
01 / EmitIndependent producer
A synthetic producer emits metadata and assurance fields.
Authoritative source
Who can establish the fact?
Custom assurance fieldsCorrelation purposeEngineering template / not deployedSeparate enforcement pointView this threat surface →Synthetic event preview
Missing evidence is not evidence of misconduct. Trace IDs connect observations; they do not authenticate a principal or prove an outcome.
The pipeline is only the beginning
AI DDR closes the response loop.
A detection has operational value only when someone owns the decision, an independent control can intervene, and the resulting state is verified.
Normalize
Preserve origin, time, identity and task relationships.
Detect
Compare evidence with approved baselines and hard boundaries.
Decide
Name the responder, authority, rationale and escalation.
Contain
Enforce interruption and verify children and credentials stopped.
Recover
Test integrity and return-to-service conditions.
Govern
Assign corrective action, residual risk and evidence of closure.
Engineering contract
Observations are not control verdicts.
OpenTelemetry describes operations. The proposed practical_trust.* fields carry independent assurance evidence. Neither a trace nor a dashboard grants authority to act.
Two supplied schemas. No silent equivalence.
The integrated threat map retains illustrative ai.* predicates with rule identifiers HB-AI-000 through HB-AI-018. The component field map uses the proposed practical_trust.* assurance namespace and HB-AI-600 through HB-AI-618. They are separate source designs, not interchangeable aliases.
This explorer uses the latter contract for synthetic events. It preserves the earlier predicates in the full source reference. A production implementation must explicitly map types, identifiers, semantics and rule versions; it must not rename fields and assume the rule still means the same thing.
The browser uses a small deterministic fixture evaluator, not Elastic KQL or EQL. Rule text is an engineering template, not a deployed or syntax-validated Elastic detection.
Elastic integration, without implied deployment
The animation depicts a protected collector, explicit normalization and a curated security-event projection. The actual collector, exporter, index templates and detection rules depend on the Elastic deployment and pinned versions.
Elastic documents managed OTLP ingestion and collector-based paths. OTel-native storage and ECS-based security analytics are not automatically identical; the mapping must be designed and tested. A durable material-action evidence path must remain independent of diagnostic sampling.
GenAI semantic conventions are still evolving. Pin the schema and instrumentation versions. Raw prompts, output bodies, tool arguments, tokens and personal identifiers are deliberately absent from these demo events.
Implementation context checked 27 October 2026: OpenTelemetry GenAI attributes; Elastic OpenTelemetry ingestion guidance; ECS custom fields. These sources supplement the supplied documents; they do not certify the illustrative rules.
Complete component field map
Every surface. Its producer. Its evidence.
All 19 rows from the supplied v1.0 field map, including standard fields, custom assurance fields, correlation use, threat classes and draft rule identifiers. Original shorthand is retained; custom field names carry the practical_trust.* prefix.
19 of 19 components
6.00Generative model
Standard fields / source notation
gen_ai.operation.name, gen_ai.provider.name, gen_ai.request.model, gen_ai.response.model, gen_ai.request.temperature / max_tokens / stream, gen_ai.usage.input_tokens / output_tokens / reasoning.output_tokens / cache_read.input_tokens, gen_ai.evaluation.result event (name, score.value, score.label, explanation)
Custom fields / practical_trust.*
model.approved, model.approval_ref, model.resolved_deployment
Authoritative producer
Model gateway plus signed deployment registry (not the SDK's self-reported model string)
AI DDR / MDR correlation use
D: requested or responding model outside the approved mapping (lead R1); B: finish-reason and token-distribution shift (R7); A: jailbreak and system-prompt extraction attempts seen as eval-threshold failures. Token counts never establish correctness or conformance
Source-assigned threat classes
AML.T0054 jailbreak, T0057 LLM data leakage, T0056 extract system prompt, T0060 hallucinated entities; ASI01; LLM07, LLM09, LLM10
Draft Elastic rule / not executable here
HB-AI-600: model.approved false or eval.threshold_status fail
D = deviation from approved baseline; B = behavioral drift; A = AI-targeted attack signal. A signal still requires investigation.
6.01Inputs & external content
Standard fields / source notation
gen_ai.input.messages (restricted, optional), event.original (restricted), url.domain, source.ip
Custom fields / practical_trust.*
input.origin_class, input.fingerprint, input.instruction_indicator, input.classifier_id, input.classifier_score, input.modality; request.tenant, request.subject_ref; content.lineage_id, content.source_scope, content.destination_scope
Authoritative producer
Ingress gateway / content detector; ingress plus IdP; lineage service / DLP
AI DDR / MDR correlation use
A: external-origin content carrying instruction patterns that later precedes a tool call (R5); field-size anomalies; D: content lineage crossing from source scope to a destination scope it was not approved for. A content digest is an integrity clue, not an instruction boundary
Source-assigned threat classes
AML.T0051.001/.002 indirect and triggered injection, T0093 infiltration via public app, T0078 drive-by, T0129 multimodal triggers, T0134 AI-targeted cloaking; ASI01; LLM01
Draft Elastic rule / not executable here
HB-AI-601: origin_class external and instruction_indicator true
D = deviation from approved baseline; B = behavioral drift; A = AI-targeted attack signal. A signal still requires investigation.
6.02Orchestrator / agent loop
Standard fields / source notation
gen_ai.operation.name invoke_agent, gen_ai.agent.id / name / version, gen_ai.workflow.name, gen_ai.conversation.id
Custom fields / practical_trust.*
agent.privilege_edge_unapproved, agent.fanout_limit_exceeded, agent.parent_ref, agent.child_ref, agent.call_depth, agent.tool_graph_version
Authoritative producer
Orchestrator plus graph-policy verifier (the approved agent-to-agent graph as a control artefact)
AI DDR / MDR correlation use
D: invocation depth or fan-out above baseline; privileged agent invoked by a lower-privilege caller; stop-condition and loop-budget breaches; B: tool-graph version changes between sessions; A: autonomous orchestration and discovery of runtime capabilities
Source-assigned threat classes
AML.T0118.001 direct agent communication, T0124 autonomous attack orchestration, T0084.001 / T0133 capability discovery, T0034.002 agentic resource consumption; ASI07, ASI08, ASI10; LLM06
Draft Elastic rule / not executable here
HB-AI-602: privilege_edge_unapproved or fanout_limit_exceeded
D = deviation from approved baseline; B = behavioral drift; A = AI-targeted attack signal. A signal still requires investigation.
6.03RAG subsystem
Standard fields / source notation
gen_ai.operation.name retrieval (where supported), gen_ai.data_source.id, gen_ai.retrieval.documents
Custom fields / practical_trust.*
retrieval.acl_violation, retrieval.index_digest_mismatch, retrieval.result_tenant, retrieval.document_ref, retrieval.corpus_id, retrieval.result_count, index.manifest_digest; access.decision_id
Authoritative producer
Corpus registry / index attestor; retriever plus source ACL service; source ACL / PDP
AI DDR / MDR correlation use
D: results outside the caller's ACL or tenant; index digest differing from the registered corpus manifest (this is the Platinum release check); B: retrieval volume and scope drift (R4); A: RAG poisoning and credential harvesting from indexed secrets. A source ID alone does not prove historical corpus contents
Source-assigned threat classes
AML.T0070 RAG poisoning, T0071 false RAG entry, T0064 gather RAG targets, T0082 RAG credential harvesting, T0085.000 data from RAG databases; ASI06; LLM08, LLM02
Draft Elastic rule / not executable here
HB-AI-603: acl_violation or index_digest_mismatch
D = deviation from approved baseline; B = behavioral drift; A = AI-targeted attack signal. A signal still requires investigation.
6.04Memory & state
Standard fields / source notation
gen_ai.conversation.id
Custom fields / practical_trust.*
memory.authority_ref, memory.retention_class, memory.cross_principal_read, memory.unauthorized_write, memory.record_ref, memory.ttl_expires_at
Authoritative producer
Memory store access logs (independent store confirmation, not the agent's claim)
AI DDR / MDR correlation use
D: writes originating from external-provenance content; TTL and write-authorisation violations; reads across principal boundaries; B: retention-class drift; A: delayed-execution instructions persisted in memory (R8). A missing record ID does not prove deletion
Source-assigned threat classes
AML.T0080.000/.001 memory and thread poisoning, T0094 delayed execution, T0092 manipulate chat history; ASI06; LLM04
Draft Elastic rule / not executable here
HB-AI-604: unauthorized_write or cross_principal_read
D = deviation from approved baseline; B = behavioral drift; A = AI-targeted attack signal. A signal still requires investigation.
6.05Context assembly
Standard fields / source notation
gen_ai.system_instructions (restricted, optional), gen_ai.input.messages
Custom fields / practical_trust.*
context.origin_classes, context.protected_instruction_truncated, context.template_digest_match, context.token_budget, prompt.template_digest
Authoritative producer
Signed template registry; trusted context compiler
AI DDR / MDR correlation use
D: template digest not matching the signed registry (R11); protected instructions truncated by overflow; A: external content adjacent to protected instructions in context lineage; obfuscation and self-replicating prompts. Recorded without routinely exporting prompt bodies
Source-assigned threat classes
AML.T0069.000 special character sets, T0068 obfuscation, T0061 self-replication, T0018.003 modify prompt construction; ASI01; LLM01, LLM07
Draft Elastic rule / not executable here
HB-AI-605: protected_instruction_truncated or template_digest_match false
D = deviation from approved baseline; B = behavioral drift; A = AI-targeted attack signal. A signal still requires investigation.
6.06Input / output guardrails
Standard fields / source notation
gen_ai.output.messages (restricted, optional), url.domain
Custom fields / practical_trust.*
guardrail.bypass_detected, guardrail.policy_ref, guardrail.confidence, output.unsafe_egress_url
Authoritative producer
Independent guardrail evaluator; output renderer plus egress monitor
AI DDR / MDR correlation use
D: actions proceeding on a guardrail allow with no gate decision; bypass-path tests failing; A: outputs carrying external references with encoded parameters (the ForcedLeak pattern); B: classifier confidence and version drift. Zero filter hits does not prove filtering was on (R7, R12)
Source-assigned threat classes
AML.T0054 jailbreak, T0065 prompt crafting, T0077 response rendering; ASI09; LLM05
Draft Elastic rule / not executable here
HB-AI-606: bypass_detected or unsafe_egress_url
D = deviation from approved baseline; B = behavioral drift; A = AI-targeted attack signal. A signal still requires investigation.
6.07Policy / authorization gate
Standard fields / source notation
event.action policy_decided, user.id
Custom fields / practical_trust.*
authz.receipt_status, authz.policy_version, authz.receipt_id, policy.digest; action.fingerprint, action.material, action.target; decision.id; request.tenant, request.subject_ref; access.decision_id
Authoritative producer
The separate authorization service records its decision using approved, signed rules; the executing system verifies that permission matches the request
AI DDR / MDR correlation use
Compare what was permitted with what actually ran. Investigate a missing, expired, reused or invalid decision receipt, an unauthorized rule change, or an agent approving itself. A receipt records permission, not proof of safety or completion. A missing record is an evidence gap to investigate, not proof of an attack.
Source-assigned threat classes
AML.T0081 modify agent configuration, T0132 misconfigured or exposed AI services; ASI03, ASI02; LLM06
Draft Elastic rule / not executable here
HB-AI-607: action.material true and receipt_status missing / expired / invalid / replayed
D = deviation from approved baseline; B = behavioral drift; A = AI-targeted attack signal. A signal still requires investigation.
6.08Credential broker
Standard fields / source notation
event.action credential_issued, user.id
Custom fields / practical_trust.*
credential.reference, credential.scope, credential.ttl, credential.scope_violation, credential.revoked_used, credential.use_accepted, credential.expires_at, credential.revoked_at
Authoritative producer
Token broker / relying target (issuance and acceptance from both sides)
AI DDR / MDR correlation use
D: one credential used across more targets than the task scope; privileged tool call under a delegated identity with no delegation record; revoked credential accepted; B: TTL drift toward standing privilege; A: credential harvesting from agent configuration (R9)
Source-assigned threat classes
AML.T0083 credentials from agent configuration, T0098 tool credential harvesting, T0091.000 application access token, T0012 valid accounts; ASI03; LLM02
Draft Elastic rule / not executable here
HB-AI-608: scope_violation or revoked_used
D = deviation from approved baseline; B = behavioral drift; A = AI-targeted attack signal. A signal still requires investigation.
6.09Extensions / MCP / skills
Standard fields / source notation
gen_ai.tool.definitions, gen_ai.tool.type
Custom fields / practical_trust.*
extension.attestation_status, extension.digest, extension.digest_mismatch, extension.publisher_ref, extension.endpoint_id; allowlist.version
Authoritative producer
Publisher / MCP registry verifier; asset inventory / egress proxy
AI DDR / MDR correlation use
D: tool definitions changing between sessions; unregistered MCP endpoint; digest differing from the attested package; A: tool poisoning, rug pull, reputation inflation; cross-tenant object IDs in tool responses. A Nuix Neo MCP endpoint registers here
Source-assigned threat classes
AML.T0110 tool poisoning (.000 definition, .001 implementation, .002 runtime), T0010.005 supply chain agent tool, T0109 rug pull, T0115.002 publish poisoned tools, T0111 reputation inflation; ASI04; LLM03
Draft Elastic rule / not executable here
HB-AI-609: attestation_status missing / invalid / revoked or digest_mismatch
D = deviation from approved baseline; B = behavioral drift; A = AI-targeted attack signal. A signal still requires investigation.
6.10Tool dispatcher
Standard fields / source notation
gen_ai.operation.name execute_tool, gen_ai.tool.name, gen_ai.tool.call.id, gen_ai.tool.call.arguments / result (restricted, optional)
Custom fields / practical_trust.*
dispatch.receipt_match, dispatch.budget_reservation_valid, dispatch.action_id, dispatch.tool_id; action.fingerprint, action.material, action.target; content.lineage_id / source_scope / destination_scope
Authoritative producer
Independent action dispatcher; independent PDP / dispatcher
AI DDR / MDR correlation use
D: execute_tool with no matching gate receipt or no valid budget reservation; tool call to a target outside declared scope; blanket auto-approval in effect; A: write or destructive calls whose arguments contain external-provenance content (R3, R5). An execute_tool span alone does not prove the effect
Source-assigned threat classes
AML.T0053 tool invocation, T0086 exfiltration via tool, T0101 data destruction via tool, T0085.001 data from agent tools, T0100 agent clickbait; ASI02, ASI05; LLM06
Draft Elastic rule / not executable here
HB-AI-610: execute_tool and (receipt_match false or budget_reservation_valid false)
D = deviation from approved baseline; B = behavioral drift; A = AI-targeted attack signal. A signal still requires investigation.
6.11Sandbox / downstream systems
Standard fields / source notation
destination.ip, url.domain, deployment.environment.name, event.outcome
Custom fields / practical_trust.*
downstream.request_id, effect.status, effect.environment_violation, effect.outcome_mismatch, effect.unapproved_egress, effect.affected_rows, effect.verified_by, effect.verification_time; allowlist.version; recovery.reference
Authoritative producer
System-of-record audit; target system / outcome verifier; recovery verifier / ITSM
AI DDR / MDR correlation use
D: production mutation from a non-production identity; egress to an allowlisted host whose registration lapsed; agent-reported outcome differing from the target system's own log; B: affected-row counts above the approved ceiling; A: exfiltration, escape to host, writes of private lineage to public surfaces. Validate through the target's own logs; late traces require reconciliation
Source-assigned threat classes
AML.T0048 external harms, T0025 exfiltration via cyber means, T0105 escape to host, T0122 exploitation of remote services; ASI08; LLM02, LLM05
Draft Elastic rule / not executable here
HB-AI-611: environment_violation or unapproved_egress or outcome_mismatch
D = deviation from approved baseline; B = behavioral drift; A = AI-targeted attack signal. A signal still requires investigation.
6.12Observability & audit
Standard fields / source notation
trace.id, span.id, event.ingested, telemetry.sdk.version
Custom fields / practical_trust.*
producer.identity, producer.trust_level, producer.signature_status, producer.coverage_id; evidence.contract_id, evidence.artifact_hash, evidence.artifact_uri, evidence.coverage_status, evidence.integrity_status; collector.loss_slo_breached, collector.dropped_events, collector.ingest_delay_ms, collector.heartbeat_at
Authoritative producer
Collector identity registry; evidence store / integrity checker; OTel / secure log collector
AI DDR / MDR correlation use
D: agent claims (tests passed, rollback done) with no corroborating producer event; gaps in producer coverage; evidence integrity failures; B: collector loss, delay and heartbeat drift that would silently blind every other rule; A: citation and chat-history manipulation, masquerading. Sampling can discard evidence tail sampling cannot recover; material-action records need a separate durable path
Source-assigned threat classes
AML.T0067 trusted output manipulation, T0067.000 citations, T0074 masquerading, T0092 manipulate chat history; ASI09, ASI10; LLM09
Draft Elastic rule / not executable here
HB-AI-612: coverage_status gap or integrity_status invalid or loss_slo_breached
D = deviation from approved baseline; B = behavioral drift; A = AI-targeted attack signal. A signal still requires investigation.
6.13Identity & delegation
Standard fields / source notation
user.id, gen_ai.agent.id
Custom fields / practical_trust.*
delegation.chain_id, delegation.expires_at, delegation.scope, delegation.scope_subset, delegation.revoked_child_active, delegation.parent_ref, delegation.child_ref, delegation.revoke_command_id
Authoritative producer
Identity and delegation issuer (trusted identity service; never client-written agent IDs or trace headers)
AI DDR / MDR correlation use
D: a hop whose child scope is not a subset of the parent's; a child still running after revocation; an action with no delegation chain back to a human owner; B: delegation expiry drifting toward standing grants; A: deploy-AI-agent and valid-accounts abuse across organisation boundaries
Source-assigned threat classes
AML.T0118.001, T0091.000, T0083, T0012, T0103 deploy AI agent; ASI03, ASI07; LLM06
Draft Elastic rule / not executable here
HB-AI-613: scope_subset false or revoked_child_active
D = deviation from approved baseline; B = behavioral drift; A = AI-targeted attack signal. A signal still requires investigation.
6.14Evaluation & conformance
Standard fields / source notation
gen_ai.evaluation.result event (name, score.value, score.label, explanation), gen_ai.request.model / response.model
Custom fields / practical_trust.*
eval.model_ref, eval.suite_version, eval.dataset_version, eval.threshold_status, eval.release_binding_valid, eval.score, eval.judge_version
Authoritative producer
Independent evaluation runner
AI DDR / MDR correlation use
B: degraded grounding, accuracy or bias behind a stable model name; suite, dataset or evaluator version drift; D: resolved deployment outside the approved set; failed evaluation not routed to an independent release decision; A: training-data poisoning and model supply-chain substitution. eval.dataset_version is where the Platinum corpus release is bound to the evaluation
Source-assigned threat classes
AML.T0031 erode model integrity, T0020 training data poisoning, T0018.003, T0010.003 supply chain model, T0067; ASI04, ASI10; LLM04, LLM09
Draft Elastic rule / not executable here
HB-AI-614: threshold_status fail or release_binding_valid false
D = deviation from approved baseline; B = behavioral drift; A = AI-targeted attack signal. A signal still requires investigation.
6.15Human oversight console
Standard fields / source notation
event.action oversight_decided, user.id
Custom fields / practical_trust.*
oversight.evidence_id, oversight.approval_binding_valid, oversight.interrupt_stop_verified, oversight.reviewer_ref, oversight.stop_observed_at, approver.reference; decision.id
Authoritative producer
Human identity provider; independent review console
AI DDR / MDR correlation use
D: approver identity equal to the agent's; approval reused across actions or past expiry; interrupt issued with no observed stop in the execution and identity layers; B: approvals faster than the evidence could be read (rubber-stamp drift); A: impersonation and delayed execution after the approval window
Source-assigned threat classes
AML.T0067, T0073 impersonation, T0094 delayed execution, T0100, T0092; ASI09; LLM09
Draft Elastic rule / not executable here
HB-AI-615: approval_binding_valid false or interrupt_stop_verified false
D = deviation from approved baseline; B = behavioral drift; A = AI-targeted attack signal. A signal still requires investigation.
6.16AI BOM & attestation
Standard fields / source notation
gen_ai.agent.version, gen_ai.tool.definitions, service.version
Custom fields / practical_trust.*
attestation.verification, attestation.verifier, manifest.digest, manifest.digest_match, registry.release_id, release.status
Authoritative producer
AI asset registry; artifact verifier; release controller; release registry (trusted verifier, not the workload's own digest)
AI DDR / MDR correlation use
D: runtime manifest digest differing from the registry; an MCP endpoint, tool, policy or index with no registry entry; a digest reported by the workload with no independent verification (R11); A: supply-chain substitution, rug pull, configuration acquisition. registry.release_id is the handle for a Platinum corpus release at step 0. Digest equality does not prove origin or rights
Source-assigned threat classes
AML.T0010.005, T0109, T0110, T0115.002, T0111, T0081, T0002.002 acquire agent configuration; ASI04; LLM03
Draft Elastic rule / not executable here
HB-AI-616: attestation.verification failed or manifest.digest_match false or release.status unregistered
D = deviation from approved baseline; B = behavioral drift; A = AI-targeted attack signal. A signal still requires investigation.
6.17Authority & consumption
Standard fields / source notation
gen_ai.usage.input_tokens / output_tokens, gen_ai.request.max_tokens
Custom fields / practical_trust.*
budget.consumed, budget.limit, budget.over_limit, budget.reservation_id, budget.reservation_status, budget.unit, budget.balance, budget.currency
Authoritative producer
Atomic central quota ledger (gateway or dispatcher reservation, not the SDK's token counter)
AI DDR / MDR correlation use
D: dispatch with no ledger reservation; budget reset at a delegation hop; concurrent reservations exceeding the task-family ceiling; B: consumption and cost above a validated baseline (R6); A: cost harvesting, denial of AI service, mass mutation without a transaction ceiling. Token counts are not total spend and an anomaly is not proof of exfiltration
Source-assigned threat classes
AML.T0034.002, T0034 cost harvesting, T0029 denial of AI service, T0048.000 financial harm, T0101; ASI08, ASI10; LLM10
Draft Elastic rule / not executable here
HB-AI-617: reservation_status missing or over_limit
D = deviation from approved baseline; B = behavioral drift; A = AI-targeted attack signal. A signal still requires investigation.
6.18Transparency & recourse
Standard fields / source notation
event.action, user.id
Custom fields / practical_trust.*
recourse.decision_unverifiable, recourse.explanation_sensitive_data, recourse.notice_ref, recourse.appeal_ref, recourse.outcome_ref; decision.id; recovery.reference
Authoritative producer
Notice and appeal system
AI DDR / MDR correlation use
D: decision record with no verified outcome behind it; contest outcome not linked to the original decision; A: explanation containing unredacted trace content, third-party data, prompts or security controls (sensitive disclosure through the recourse channel itself); B: response biasing and citation manipulation in rendered explanations
Source-assigned threat classes
AML.T0067.000, T0130 agent response biasing, T0092, T0057, T0077; ASI09; LLM02, LLM09
Draft Elastic rule / not executable here
HB-AI-618: decision_unverifiable or explanation_sensitive_data
D = deviation from approved baseline; B = behavioral drift; A = AI-targeted attack signal. A signal still requires investigation.
The event envelope joins the evidence.
| Namespace | Fields | Producer | Role in correlation |
|---|---|---|---|
| Elastic Common Schema | @timestamp, event.id, event.dataset (ai_harness.control), event.action, event.kind, event.category, event.type, event.outcome, event.ingested, event.original, data_stream.type / dataset / namespace, service.name, service.version, user.id, host.name, source.ip, destination.ip, url.domain | OTel / ECS ingest or source | Normalised routing into the ai_harness.control data stream; event.action carries the contract stage (policy_decided, credential_issued, context_assembled, guardrail_evaluated, oversight_decided); outcome and category feed standard SIEM analytics |
| ECS trace linkage | trace.id, span.id | OTel / ECS ingest or source | Joins observations across producers and vendors; the reference model stresses that a trace ID connects observations but does not authenticate a person or prove an outcome |
| OTel resource | deployment.environment.name, telemetry.sdk.name, telemetry.sdk.version, error.type | Application / OTel SDK | Distinguishes production from non-production identities (a 6.11 signal) and pins the instrumentation version that must be recorded with any rule |
| practical_trust (task context) | practical_trust.schema.version, practical_trust.component.id, practical_trust.rule.id, practical_trust.verdict, practical_trust.task.id, practical_trust.task.family_id, practical_trust.task.purpose, practical_trust.task.consequence_class | Schema registry; asset registry; detection-engineering registry; trusted task registry; trusted evidence verifier | component.id routes the event to its rule; task.family_id is what lets a shared budget and a delegation chain be reconciled across child agents and retries; consequence_class is the materiality switch that decides whether a gate decision and human approval were required at all |
Not everything belongs in the SIEM.
Source-defined collection tiers. Restricted content needs an approved purpose and a separate access path; a general alert should carry a controlled evidence reference, not the underlying content.
| Tier | Fields | Collection level | Destination |
|---|---|---|---|
| Low (routing and correlation) | All ECS envelope fields except those below; practical_trust task context, component.id, rule.id, verdict; all boolean and status assurance fields (acl_violation, bypass_detected, receipt_status, digest_match, over_limit and the rest) | Required or conditional | SIEM security-event correlation tier; retained independently of diagnostic sampling |
| Internal (identifiers and digests) | gen_ai.request.model and request parameters, token-usage counters; input.fingerprint; request.tenant; content.lineage_id / source_scope / destination_scope; index.manifest_digest; memory.record_ref; prompt.template_digest, context.token_budget; policy.digest; action.fingerprint; all credential.* fields; extension.digest; delegation.scope; manifest.digest, registry.release_id; host.name, source.ip, destination.ip, url.domain | Conditional | Metadata traces with analyst access controls; joined to the SIEM tier by trace.id and task.id |
| Restricted (content and people) | gen_ai.input.messages, gen_ai.output.messages, gen_ai.system_instructions, gen_ai.tool.call.arguments, gen_ai.tool.call.result, event.original, user.id; request.subject_ref; retrieval.result_count, retrieval.result_tenant; evidence.artifact_uri; approver.reference, oversight.reviewer_ref | Optional or conditional, by approved purpose only | Restricted content store; never into general alerts; lead R10 fires when a prohibited field arrives in an evidence destination |
Source basis: supplied DavisAIgov / HoundBytes / Elastic Integrated Threat Map, reference v1.1, and AI Harness Telemetry to SIEM — Component Field Map, v1.0, 27 October 2026. Site release v13.5.6; interactive module v1.0.0. Historical reference-model versions remain identified as historical. Download the source-derived visual dataset.