Audit Logs Monitoring and Response

[All Actors]
1. Establish behavioral baselines for each system layer (infrastructure, orchestration, application, model endpoints) to distinguish normal from anomalous activity.

2. Continuously ingest and analyse audit logs with rules-based and/or ML-driven detection engines.

3. Generate real-time alerts when events deviate from baseline or match high-severity indicators; include user, asset, action, timestamp and source.

4. Route alerts to an incident-response workflow with defined roles, investigation steps, containment / remediation actions and escalation timelines.

5. Document every anomaly investigation (findings, root cause, actions taken, lessons learned) and link records to the corresponding log events.

6. Review and tune detection logic, thresholds and playbooks on a regular basis, or immediately after major incidents, architecture changes or new threat intelligence.

1. Inquiring with Control Owners

1.1 Conduct interviews with personnel responsible for monitoring cloud infrastructure security audit logs and detecting anomalous resource usage patterns to understand their anomaly detection processes for AI processing infrastructure and customer workloads. Verify their understanding of baseline infrastructure behavior, customer usage patterns, and the defined process for reviewing and taking timely actions on detected security anomalies in cloud infrastructure operations.

2. Inspecting Records and Documents

2.1 Verify cloud infrastructure logs are monitored using automated systems for compute resources, storage access, network traffic, and customer workload activities.

2.2 Confirm alerts are configured for events such as unauthorized resource access, abnormal compute usage, suspicious network patterns, or customer workload boundary violations.

2.3 Check documented procedures exist for infrastructure log anomaly triage and root cause analysis of cloud security incidents.

2.4 Review monitoring dashboards for infrastructure layers, resource utilization patterns, customer activities, and access history.

2.5 Validate response actions are documented and tested for infrastructure-specific security incidents through simulations or real events.

2.6 Confirm evidence retention processes are triggered upon infrastructure security alert detection.

2.7 Examine documented baseline patterns for normal infrastructure operations and criteria used to identify security anomalies in compute usage, storage access, and customer workload activities.

2.8 Review the defined process for timely review and action on detected infrastructure anomalies, including escalation to cloud operations teams and response timeframes.

2.9 Validate that cloud infrastructure security audit log monitoring covers hypervisor activities, GPU/TPU usage, network communications, and customer tenant isolation events.

2.10 Confirm periodic review and tuning of infrastructure anomaly detection thresholds to reduce false positives while detecting sophisticated infrastructure attacks and customer security violations.

2.11 Confirm centralized log monitoring systems aggregate and analyze logs from all infrastructure and services.

2.12 Verify alerts are generated for privilege escalations, unauthorized API access, and failed access attempts.

2.13 Validate incident response teams are notified and take action per documented SLAs.

2.14 Check logs are integrated with automated remediation tools where applicable.

2.15 Review historical incident timelines to confirm log-based detection led to timely resolution.

2.16 Confirm CSP's monitoring framework is tested regularly through tabletop or real-world exercises.

2.17 Ensure multi-tenant log monitoring is segregated with independent alert channels per customer.