Defending the Defenders' AI: Poisoned Telemetry, Hostile Tickets and the SOC as Tier 0

All courses / AI Blue / Module 3 / Chapter 15

Learning objectives

After the lesson the participant can:

Classify the inputs of a SOC AI capability into the trust classes T0 Own, T1 Telemetry, T2 Submitted and T3 Published
Explain the four consequence classes of a manipulated agent and which control bounds each
Review a new SOC AI capability with the ten-question pre-production checklist
Describe what treating the SOC platform as tier 0 means for identity, change, recovery and personal data

Key concepts

Trust classes T0 to T3: A classification of every input by who can influence the text: T0 Own from the SOC's deterministic tooling, T1 Telemetry with attacker-chosen fields, T2 Submitted by any person, T3 Published by third parties. The class travels with the data.
Four consequence classes: What a manipulated agent can cause, described by effect: suppression of an alert, misdirection of the analyst, disclosure of case data or credentials, and action on the estate that the adversary wanted.
Containment profile: The permission manifest the policy decision point reads for an agent, such as CP-HM-SOC-01: its input channels with trust classes and each tool with action, reversibility, level and scope.
Canary: A decoy that no legitimate process touches, such as a ticket with instruction-like text addressed to the agent, a decoy credential or a decoy tool. Touching it raises an alert to a person and exposes a steered agent.
SOC as tier 0: The SOC platform is among the assets whose compromise gives control of everything else, so it has separate administrative identities, change only by reviewed pull request and recovery that does not depend on itself.

Interactive exercises

Do them here and get feedback at once. Choose a card and then where it belongs, or drag it.

Interactive exercise 1 · Sort

Who could have written this input?

Sort each input to a SOC AI capability into the trust class the chapter assigns by who can influence the text.

Interactive exercise 2 · Scenario

The note that lost its label

Apply the chapter's reading of the red-team finding FND-HM-2027-014.

Teaching plan

15 min	Teacher takes one ordinary alert apart field by field and shows who could have written each string, then presents the four trust classes.
15 min	Groups map the four consequence classes to the controls outside the model: policy decision point, deterministic corroboration, separation of reading from acting, egress and credentials, canaries.
40 min	Exercise: groups complete the ten-question pre-production checklist for a new SOC AI capability and mark each answer verified or declared.
20 min	Design review of the finding FND-HM-2027-014: which control held, which failed and why the remedy is in the case store and not in the model.
15 min	Closing input on tampering with detection, gated feedback, the supply chain of security AI and the outlook labels.

Discussion

T1 Telemetry is the class that most surprises teams who treat logs as ground truth. Which log fields in your estate are strings that an outside actor controls?
The controls bound suppression, action and disclosure but not what a manipulated agent can make an analyst believe. How do Chapters 14 and 15 divide the work between them?
Nordvik Region's exposure is contractual and Hansa Mutual's is architectural. Which of the two is harder to verify, and what evidence would you ask for in each case?

Written exercise

Exercise · 40 minutes

Pre-production checklist for a SOC AI capability

Take a SOC AI capability your team plans to enable, an agent, a copilot or a vendor feature, or use Hansa Mutual's investigation agent as documented in CP-HM-SOC-01. Answer the ten questions of the practical guide with evidence: inputs and their trust classes; tools with action class, reversibility and scope; the level per action class with no Level 4; enforcement by a policy decision point outside the model; the deterministic source that corroborates each conclusion; the egress policy; credentials with lifetime and revocation time; a canary on each input channel; the holder of the stop right and the last stop drill; and the exit. Mark each answer verified or declared, and give every declared answer an expiry date.

Deliverable: A completed ten-question checklist with evidence references, a verified or declared status per answer, expiry dates and a scheduled red-team exercise.

Your work

Self-test

Choose an answer to see whether it is right, or open the answer below each question.

Into which trust class does the chapter place a web log or a command line recorded by the organisation's own systems?
Show the answer
C. T1 Telemetry, because the record contains attacker-chosen fields
T1 Telemetry is produced by systems the organisation runs but contains fields that any party able to cause the event can choose. A log line records an event, but strings inside it were controlled by the actor.
Which consequence of a manipulated agent do the controls outside the model not bound, leaving it to the review of Chapter 14?
Show the answer
B. Misdirection, the steering of what the analyst believes
The summary states that suppression is caught by sampling, action is held by the decision point and disclosure by egress, but the controls do not bound what a manipulated agent can make an analyst believe.
What status does a control on the SOC's AI have if it has not been tested, under the standard the chapter takes from AI Threat, Chapter 30?
Show the answer
D. Declared, and not verified
A control counts as a defence only when a test that re-runs its scenario has passed recently. Untested, it is declared, which is why the SOC's AI is red-teamed under rules of engagement.