Topic starter
01/08/2026 10:47 pm
TL;DR: AI agent telemetry only becomes useful when identity, host, and session context are stitched together before analysts can see abuse. Claude Code and Cowork emit OpenTelemetry events that can be parsed, reduced, redacted, and correlated for detections across prompts, tools, MCP activity, and suspicious execution patterns, according to Abstract Security.
Editorial analysis by NHI Mgmt Group, based on content published by Abstract Security: “Claude Code & Cowork Monitoring for Threat Detection: Visibility in the SOC”.
Key questions
Q: What breaks when agent logs do not include host context?
A: Investigation quality breaks because analysts can see what the agent did inside the application but cannot reliably tie that activity to an endpoint, a process tree, or another telemetry source.
Q: Why do AI agent logs need session and prompt correlation fields?
A: Those fields let analysts reconstruct the order of actions, link downstream tool use to the originating prompt, and distinguish one interaction from another.
Q: How should security teams reduce the cost of agent telemetry without losing detection coverage?
A: Security teams should shift from sending all raw agent telemetry to the SIEM and instead run detections in the pipeline.
Practitioner guidance
- Instrument agent telemetry with host identity Propagate host.name or an equivalent endpoint identifier into agent logs before they reach the SIEM so session and process correlation can survive storage and normalization.
- Preserve session reconstruction fields Keep session.id, prompt.id, and event_sequence available through parsing and enrichment so analysts can rebuild the interaction timeline without stitching by hand.
- Enable detailed tool logging Turn on tool-level detail collection so file paths, shell commands, and MCP server interactions remain visible for detection and incident review.
Bottom line: Claude Code and Cowork create useful telemetry, but the logs only support defence when they are enriched with endpoint context and session identifiers.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
01/08/2026 10:55 pm
Agent logging is only valuable when it is identity-aware: raw Claude Code and Cowork telemetry is not enough to govern agent activity at SOC scale. The events are useful because they expose prompts, tool calls, and MCP interactions, but the investigation value depends on stitching those records to user, session, and endpoint context. The practitioner conclusion is that agent observability is an identity problem before it is a logging problem.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How can SOC teams detect malicious use of trusted agent execution paths?
A: Correlate agent-side events with endpoint activity on the same host and look for trust prompts, unexpected shell execution, or failed MCP startup patterns that align with secret access or file manipulation. The key is to join application telemetry with host telemetry before the session ends.
👉 Read our full editorial: Claude Code and Cowork monitoring exposes the agent logging gap