A Field Guide to Detecting Risky Activity in AI Tooling Logs
Summary
A guide to visibility in logs from Claude Code, Cursor, OpenAI Enterprise and Codex, and Google Workspace Gemini, with detection ideas and limitations. It emphasizes combining log sources and adding context because no single source provides complete visibility.
Key points
- Claude Code OpenTelemetry logs can reveal tool approvals, results, MCP use, and prompts when prompt logging is enabled; nested data may need flattening before analysis.
- Claude Code detection ideas include rejected shell commands, access to secrets, file access followed by network tools, and unknown MCP servers.
- Cursor audit logs capture configuration changes but not prompts, commands, file reads, or MCP arguments; investigations may need endpoint, network, Git, CI/CD, and hook data.
- OpenAI Enterprise audit events can support alerts for weakened network controls, disabled SCIM, reduced API logging, new permissions, and owner-level service accounts.
- Codex logs can show session settings, prompt redaction, tool approvals, and network access, enabling checks for risky configurations and unusual activity.
- Google Workspace Gemini logs show usage context but not the content involved; investigators can pivot to relevant Drive or Gmail logs and correlate identity, DLP, and endpoint data.
- No single source provides complete visibility; defenders should normalize and enrich logs, then build detections around their environment’s normal activity.
Article Details
- Defense Focus
- Improve detection and investigation of AI tooling activity by understanding each log source’s coverage and limitations, normalizing its telemetry, and building environment-specific detections.
- Detection Methods
- For Claude Code, detect rejected shell commands, access to .env files or cloud credentials, file access followed by curl or wget, and unknown MCP servers calling tools.
- For Cursor, monitor changes to Privacy Mode, added MCP servers, administrator assignments, API key creation, and weakened repository rules or hooks.
- For OpenAI Enterprise, alert on SCIM being disabled, IP allowlists being removed or broadened, new permissions, reduced API call logging, and owner-level service accounts being created.
- For Codex, identify sessions with full access and no approval, unredacted prompts leaving the machine, destructive tools approved by configuration rather than a person, unusual network traffic during enabled sessions, and new appearances on laptops or CI runners.
- For Gemini, correlate activity with Drive or Gmail logs according to app_name, matching same-user events within a tight time window and adding Login, DLP, endpoint, and identity data.
- Use environment baselines and contextual data, such as identity-provider, HR, asset-inventory, and change-ticket information, to distinguish expected activity from anomalous activity.
- Data Sources
- Claude Code OpenTelemetry metrics and logs
- Cursor audit logs and Cursor Hook data
- OpenAI Enterprise audit logs
- OpenAI Codex OpenTelemetry logs
- Google Workspace Gemini activity logs
- Endpoint, network, Git, and CI/CD data
- Identity-provider, HR, asset-inventory, and change-ticket data
- Drive, Gmail, Login, and DLP logs
- Platforms
- SIEM
- data lake
- analytics platform
- Defensive Actions
- Collect and normalize logs, flatten nested OpenTelemetry fields into searchable events, enrich them with relevant context, filter low-value events, and route prepared data to detection platforms.
- Do not assume any single source provides complete visibility; account for missing prompt, command, file, or MCP details when investigating.
- Use endpoint, network, Git, CI/CD, and Cursor Hook data to investigate Cursor agent activity that is absent from audit logs.
- Use app_name to direct Gemini investigations to the corresponding Drive or Gmail logs, then correlate related events and identity or endpoint data.
- Tune detections to normal behavior in the organization rather than deploying generic rules without adjustment.
People
Vendors
DatadogCybersecurity Pulse (TCP)! I’m Darwin Salazar, Head of Growth at Monad and former detection engineer at Datadog. Each week, I bring you the latest security innovation and industry news. Subscribe to receive weeklyIntezerBefore jumping into today’s post, next Tuesday I’m joining Mitchem Boles, Field CISO at Intezer for a webinar on fixing detection gaps at the source. We’ll get into ETL, detection engineering, and what AI SOC platformsMonadWelcome to The Cybersecurity Pulse (TCP)! I’m Darwin Salazar, Head of Growth at Monad and former detection engineer at Datadog. Each week, I bring you the latest security innovation and industry news. Subscribe to
Products
Claude CodeFor the past few months, I’ve been focused on AI tooling security visibility. Think Claude Code, Codex, Cursor etc. What activity details each log source emits, what you can detect, key threat hunting and investigationCursorFor the past few months, I’ve been focused on AI tooling security visibility. Think Claude Code, Codex, Cursor etc. What activity details each log source emits, what you can detect, key threat hunting and investigationGoogle Workspace GeminiGoogle Workspace GeminiOpenAI CodexOpenAI Codex OTel LogsOpenAI EnterpriseOpenAI Enterprise Audit LogsSigmaafter finding surprisingly little useful coverage in SIEM rule packs and public detection repos like Sigma. In recent years, AI tooling has increasingly gained access to source code, terminals, repositories,