Layer 8 of 8, Detect and respond

Monitoring and response: detect AI incidents and keep the evidence to respond

This layer collects the decisions, blocked prompts, tool calls and policy violations every other layer produces, sends them to the SIEM or an AI detection product, and gives the security operations center what it needs to detect, contain and rebuild an incident.

2 tools + 24 also cover it
Last reviewed October 21, 2026

See the tools How the eight layers work

Executive summary

What it is: This layer collects the decisions, blocked prompts, tool calls and policy violations every other layer produces, sends them to the SIEM or an AI detection product, and gives the security operations center what it needs to detect, contain and rebuild an incident.
The risk: Attacks on AI apps and agents that nobody sees, agents that keep running after they misbehave, and incidents nobody can reconstruct because logs of prompts and tool calls are missing, incomplete or editable.
What to buy or do: Require log export to your SIEM in every AI security purchase, keep tamper-evident logs of prompts and tool calls, and name who may shut a model or agent off. Add a dedicated AI detection product when agents act on production systems.

Our analysis Our editorial model, not a standard: OWASP, MITRE and NIST did not create or endorse it. Layer placements are our analysis, based on documented capabilities. How the model works.

The question this layer answers

If an AI system or agent is attacked or misbehaves, will we see it, and can we respond and prove what happened?

Budget line
An AI detection and response product, or an extension of the SIEM, EDR or XDR a security operations center already runs. Log storage often shares the budget.

What it protects against

Our analysis

Attacks on AI apps and agents that nobody sees until the damage is done
Compromised or misbehaving agents that keep running
Prompt injection and data leakage attempts that other layers block or miss, with no record
Incidents that cannot be reconstructed because logs are missing, incomplete or editable
Slow response because AI events never reach the security operations center

Typical controls

Our analysis

Export decisions, blocked events, tool calls and policy violations to the SIEM
Keep tamper-evident logs
Define who can shut a model or agent off
Detect compromised or misbehaving agents from their behavior and telemetry
Rebuild an incident from prompts, tool calls and agent actions
Alert on AI events and route them to the security operations center

How it maps to standards

Source states means the framework's own text names the control or outcome this layer delivers. Our analysis means we drew the link. OWASP LLM ids are the 2025 edition; the ATLAS hub holds the MITRE data version.

Monitoring and response: standards entries, basis, where the source says it and how it applies
Framework	Entry	Basis	Where the source says it	How it applies
OWASP LLM Top 10 (2025)	LLM04 Data and Model Poisoning	Source states	Prevention list	Monitor training loss and model behavior against thresholds.
OWASP LLM Top 10 (2025)	LLM05 Improper Output Handling	Source states	Prevention list	Log and monitor outputs to spot unusual patterns.
OWASP LLM Top 10 (2025)	LLM08 Vector and Embedding Weaknesses	Source states	Prevention list	Keep detailed, tamper-resistant logs of retrieval activity.
OWASP LLM Top 10 (2025)	LLM10 Unbounded Consumption	Source states	Prevention list	Monitor resource use and flag unusual patterns.
OWASP Agentic Top 10 (2026)	ASI01 Agent Goal Hijack (opens in a new tab) OWASP relates it to LLM01, LLM06.	Source states	Mitigations 7, 9	Comprehensive logging and monitoring of agent activity, and including agents in the insider threat program.
OWASP Agentic Top 10 (2026)	ASI02 Tool Misuse and Exploitation (opens in a new tab) OWASP relates it to LLM06.	Source states	Mitigation 8	Immutable logs of tool invocations, with monitoring for drift and policy violations.
OWASP Agentic Top 10 (2026)	ASI08 Cascading Failures (opens in a new tab) OWASP relates it to LLM01, LLM04, LLM06.	Source states	Mitigations 6, 10	Rate limiting and monitoring, and tamper-evident logging with non-repudiation.
OWASP Agentic Top 10 (2026)	ASI09 Human-Agent Trust Exploitation (opens in a new tab) OWASP relates it to LLM01, LLM05, LLM06, LLM09.	Source states	Mitigations 2, 3	Immutable logs and behavioral detection.
OWASP Agentic Top 10 (2026)	ASI10 Rogue Agents (opens in a new tab) OWASP relates it to LLM02, LLM09.	Source states	Mitigations 1, 3	Immutable, signed audit logs and behavioral detection.
NIST AI RMF	MEASURE Measure (opens in a new tab)	Source states	MEASURE 2.4	The behavior of the AI system and its components is monitored in production.
NIST AI RMF	MANAGE Manage (opens in a new tab)	Source states	MANAGE 2.3, 4.1, 4.3	Respond to and recover from unknown risks, post-deployment monitoring including incident response, and tracking of incidents and errors.
NIST AI RMF	GOVERN Govern (opens in a new tab)	Source states	GOVERN 4.3	Organizational practices enable identification of incidents and information sharing.

Tools in this layer (2)

This layer has no category of its own. A tool is placed here when its description names detection and response as its main job and it documents at least two capabilities that match the layer. Tools whose category is Agent & MCP security, listed by name. Compare them with Coverage Scores on the Agent security hub.

CrowdStrike Falcon Guardian

CrowdStrike · agent detection and response platform

Commercial
Uber ADR

Uber · open-source agent detection and response toolkit
2,072 GitHub stars as of Oct 21, 2026; last push Oct 19, 2026

Open sourceApache-2.0

Also cover this layer (24)

Our analysis Tools from other categories that document a capability in this layer. Each row names the layer the tool belongs to first and the documented capability our placement rests on.

Tools from other categories that also cover Monitoring and response, with the capability each placement rests on
Tool	Its primary layer	How it applies	Based on
agentgateway5,472 GitHub stars as of Oct 21, 2026; last push Oct 22, 2026	L7 Agent access	Documents logging of tool calls and their arguments, with OpenTelemetry traces and access logs.	MCP observability logs tool calls and their arguments after a request completes, alongside OpenTelemetry traces and access logs
Alice WonderSuite	L6 Runtime	Documents logging of every guardrail decision for audit.	Logs every guardrail decision for audit
Amazon Bedrock AgentCore Policy	L7 Agent access	Documents logging of every enforcement decision to CloudWatch, including a log-only mode.	Logs every enforcement decision to CloudWatch, and a LOG_ONLY mode records decisions without blocking requests
Astrix AI Agent Security	L7 Agent access	Documents detection of and response to threats such as compromised credentials and out-of-scope agent actions.	Detects and responds to threats such as compromised credentials and out-of-scope agent actions
Cloudflare AI Gateway	L6 Runtime	Documents request and response logs with Logpush export.	Records request and response logs and usage analytics with Logpush export
Cloudflare MCP Server Portals	L7 Agent access	Records each MCP request to a portal server, with Logpush export on Enterprise plans.	Portal logs per portal or per server record time, status, server, capability and duration; Logpush export is Enterprise only
Credo AI	L1 Governance	Documents continuous monitoring and drift detection through connected observability tools.	Continuous monitoring and drift detection through connected observability and monitoring tools
Docker MCP Gateway1,612 GitHub stars as of Oct 21, 2026; last push Oct 21, 2026	L7 Agent access	Documents a call log that records which tools were called, without raw argument values.	Logs tool calls and traces them; the call log records tool names and argument shape metadata, not raw argument values
Google Cloud Agent Gateway	L7 Agent access	Documents Cloud Logging of gateway access logs, security audit logs and dry-run policy evaluation events.	Exports network-layer telemetry to Agent Observability; Cloud Logging captures gateway access logs, security audit logs and dry-run policy evaluation events
Google Cloud Model Armor	L6 Runtime	Documents detections logged to Cloud Logging in inspect-only or inspect-and-block mode.	Logs detections to Cloud Logging in inspect-only or inspect-and-block mode
Harmonic Security	L5 Data	Documents invocation logs of each MCP tool call, with parameters, responses and the user behind it.	Keeps invocation logs of each MCP tool call, including parameters and responses, with user-level attribution
HiddenLayer AI Runtime Security (AIDR)	L6 Runtime	Documents sending runtime detections and enforcement events to SIEM, SOAR and security operations workflows.	Sends runtime detections and enforcement events to existing SIEM, SOAR and security operations workflows
IBM ContextForge4,676 GitHub stars as of Oct 21, 2026; last push Oct 21, 2026	L7 Agent access	Documents audit logging of plugin executions and policy violations at the gateway.	Documents audit logging of plugin executions and violations, with an example audit logger plugin
Invariant Guardrails472 GitHub stars as of Oct 21, 2026; last push Jan 12, 2026	L7 Agent access	Documents monitoring and steering of agent behavior without invasive code changes.	Lets teams monitor and steer agent behavior without invasive code changes
Microsoft Agent Governance Toolkit6,454 GitHub stars as of Oct 21, 2026; last push Oct 21, 2026	L7 Agent access	Documents tamper-evident records of every policy decision for agent actions.	Produces tamper-evident audit evidence for agent actions
Microsoft Purview Data Security Posture Management (DSPM) for AI	L5 Data	Documents prompts and responses recorded in the unified audit log and shown in an activity explorer.	Records prompts and responses in the unified audit log and shows them in an activity explorer
Oasis Security	L7 Agent access	Documents a record of intent, policy, identity and activity for each session, linked to an audit trail.	Records intent, policy, identity, activity and expiration for each session and links each action to an audit trail
OneTrust AI Governance	L1 Governance	Documents tracking of model and agent evaluation metrics and logging of policy violations at runtime.	Tracks model and agent evaluation metrics and logs policy violations at runtime
Pangea AI Guard	L6 Runtime	Documents an audit trail of detections, with webhooks that can trigger real-time alerts.	Logs detections in an audit trail and can trigger webhooks for real-time alerts
Protecto	L5 Data	Documents audit logs of scan, mask and unmask events.	Keeps audit logs of scan, mask and unmask events
Radware LLM Firewall	L6 Runtime	Documents dashboards that show prompts, outputs and which guardrails fired or blocked a prompt.	Dashboards show user actions, prompts and outputs, including which guardrails fired and which prompts were blocked
Saidot	L1 Governance	Documents observability and runtime monitoring that turns runtime events into governance actions.	Observability and runtime monitoring that turns runtime events into governance actions
Strands Box451 GitHub stars as of Oct 21, 2026; last push Oct 22, 2026	L7 Agent access	Documents logging of policy decisions in OTLP JSON.	Logs policy decisions in OTLP JSON
Zenity	L7 Agent access	Documents AI detection and response that detects runtime threats and blocks unsafe actions.	Detects runtime threats and blocks unsafe actions in real time

Gaps we can see

Only 2 tools in this directory have AI detection and response as the main documented job. The other tools placed in the monitoring and response layer document logging or monitoring as one feature among others, so check each tool's capabilities before you rely on it for incident response.

What this layer will not do

Monitoring sees only what other layers log, so a gap in logging is a gap here. Detection finds an incident after it starts and does not prevent one; the OWASP LLM06 page calls logging and monitoring ways to limit damage, not to prevent excessive agency. Logs of prompts and outputs can hold personal data, so the retention and access rules of layers 1 and 5 apply to them too. Two tools in this directory have detection and response as their main documented job, and the others listed here cover it beside another main job, so this layer often runs as an extension of the existing SIEM and incident process.

Monitoring and response FAQ

Why is monitoring and response a separate layer?

Because the work and the budget sit with the security operations center, not with the teams that run each control. Every other layer produces evidence, such as blocked prompts, tool calls and policy violations; this layer collects it, detects what the controls missed and drives the response. It was a cross-cutting band until published tools documented AI detection and response as their main job (two today: Uber ADR and CrowdStrike Falcon Guardian). Other tools cover it as a secondary layer, for example HiddenLayer AI Runtime Security, whose product page says it sends runtime detections and enforcement events to SIEM and SOAR workflows.

What should AI security logs capture?

Source states: the OWASP Agentic Top 10 asks for immutable logs of tool invocations (ASI02) and tamper-evident logging with non-repudiation (ASI08), the OWASP LLM08 page asks for logs of retrieval activity, and LLM10 for monitoring resource use. Our analysis: capture the prompt, the model and its version, retrieved sources, tool calls with their arguments, policy decisions and the identity the agent acted for.

Which NIST AI RMF items cover AI incidents?

MEASURE 2.4 says the functionality and behavior of the AI system are monitored in production, MANAGE 4.1 calls for post-deployment monitoring plans that include incident response, recovery and change management, and MANAGE 4.3 covers communicating incidents and errors to relevant AI actors. GOVERN 4.3 adds practices for identifying incidents and sharing information.

Framework sources & last reviewed

Last reviewed October 21, 2026. We compile from the vendors' own public pages and repositories and we do not run the products. Source links open in a new tab. Found a mistake? Report a correction.

Drafted with AI assistance; facts checked against primary sources on October 21, 2026.

OWASP Top 10 for LLM Applications 2025 (list page) (1 sources)