Topic starter
01/08/2026 10:47 pm
TL;DR: Agent telemetry from Claude Code and Cowork is useful for detection only when endpoint context and session identifiers are added before analysis, according to Abstract Security. Without those fields, prompt, tool, and MCP records stay hard to correlate, reconstruct, and redacted for incident work.
Editorial analysis by NHI Mgmt Group, based on content published by Abstract Security: “Claude Code & Cowork Monitoring for Threat Detection: Visibility in the SOC”.
Key questions
Q: Why do AI agent logs need session and prompt correlation fields?
A: Those fields let analysts reconstruct the order of actions, link downstream tool use to the originating prompt, and distinguish one interaction from another.
Q: How should security teams reduce the cost of agent telemetry without losing detection coverage?
A: Security teams should shift from sending all raw agent telemetry to the SIEM and instead run detections in the pipeline.
Q: What breaks when agent logs do not include host context?
A: Investigation quality breaks because analysts can see what the agent did inside the application but cannot reliably tie that activity to an endpoint, a process tree, or another telemetry source.
Practitioner guidance
- Instrument agent telemetry with host identity Propagate host.name or an equivalent endpoint identifier into agent logs before they reach the SIEM so session and process correlation can survive storage and normalization.
- Preserve session reconstruction fields Keep session.id, prompt.id, and event_sequence available through parsing and enrichment so analysts can rebuild the interaction timeline without stitching by hand.
- Enable detailed tool logging Turn on tool-level detail collection so file paths, shell commands, and MCP server interactions remain visible for detection and incident review.
Bottom line: Claude Code and Cowork create useful telemetry, but the logs only support defence when they are enriched with endpoint context and session identifiers.
Glossary terms: Agent telemetry, Session Reconstruction, Pipeline Redaction, Host Correlation
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 9 hours ago by NHI Mgmt Group
01/08/2026 10:55 pm
Agent logging is only valuable when it is identity-aware: raw Claude Code and Cowork telemetry is not enough to govern agent activity at SOC scale. The events are useful because they expose prompts, tool calls, and MCP interactions, but the investigation value depends on stitching those records to user, session, and endpoint context. The practitioner conclusion is that agent observability is an identity problem before it is a logging problem.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How can SOC teams detect malicious use of trusted agent execution paths?
A: Correlate agent-side events with endpoint activity on the same host and look for trust prompts, unexpected shell execution, or failed MCP startup patterns that align with secret access or file manipulation. The key is to join application telemetry with host telemetry before the session ends.
👉 Read our full editorial: Claude Code and Cowork monitoring exposes the agent logging gap