Implementation guide
OWASP AISVS v1.01
Monitoring, Logging & Anomaly Detection · Detection and Alerting
Include query details in extraction alerts
Verify that extraction-alert events include offending query metadata to support investigation.
OWASP AISVS v1.01, requirement 12.2.4
In plain English
When an extraction alert fires, it should carry the details of the queries that caused it. An alert that only says "possible extraction" sends the investigator off to find out what happened, and often they never do.
What good looks like
- Each alert includes the caller, the time range, query counts and a sample of the queries, or references to them.
- The reason for the alert is stated, such as which threshold or pattern was hit.
- The investigator can reach the full logs from the alert.
- Alert content is reviewed with the people who handle it.
How teams usually do it
- Alert templates that attach query metadata and a link to a saved search over the caller's activity.
- Summary statistics in the alert: volume, diversity and how they compare with the caller's baseline.
Suggested evidence
- Sample alerts.
- An investigation carried out from one.
Common mistakes
- Alerts with no supporting detail.
- Pasting full query text containing customer data into a chat channel or ticket with wide access.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.