AI coding-agent activity (Claude Code, Cursor, Codex) as an input to AiSOC

[blitzcrieg1]

Hi, I maintain Agentmetry (github.com/blitzcrieg1/agentmetry, Apache-2.0), an open-source sensor for AI coding agents. It records each tool call that Claude Code, Cursor, Codex and Copilot make through their own hooks, and every call through MCP servers wrapped by its proxy. It correlates sequences into detections mapped to MITRE ATT&CK and ATLAS, for example a session that pulled in an issue comment or web page and then touched credentials. It runs locally on the developer machine and forwards to the SIEM the team already has.

That looks like the layer below AiSOC: it produces the alerts your triage agents investigate, for an activity source I don't think you ingest yet. So, a question before anyone writes code.

On paper it already connects through Universal capture. Agentmetry's webhook sink POSTs one canonical JSON event per request, and detections travel the same path as events, with the severity in action.outcome, so pointing it at /v1/inbox/{tenant_token} with the generic-json template should land them. I have not tested this end to end against a running AiSOC, so treat it as a claim to check, not a result.

Would any of these be useful to you?

1. Nothing: generic-json is enough, and this thread stays as a pointer for anyone searching.
2. A bundled template mapping Agentmetry events to OCSF, plus a short docs page. I'd write both and open the PR.
3. Something else you would rather have.

What it does not cover, so nobody expects otherwise: browser chat use, model providers, and anything an agent does without its hooks enabled. Hook removal shows up as a heartbeat change, not as prevention.

If you want to see what the detections look like before deciding: pip install agentmetry && agentmetry demo

[beenuar]

Thanks for this — and for stating the generic-json claim as a claim to check rather than a result. That made the decision easy: we took your option 2, but built it in-tree ourselves so it ships tested against the rest of the pipeline. It is merged: #1580.

Your generic-json claim, checked. We captured real canonical v1.2.0 events by running agentmetry demo (PyPI 0.10.4) locally and drove them through the real embedded templates in Go tests. The events do land — the POST is accepted and events reach the event lake — but three things are lost on the way:

• Severity flattens to Unknown on every event, including a critical detection. generic-json reads a top-level severity field; yours lives at action.outcome / detection.severity — and only detection events carry a severity there (on activity events action.outcome is success/denied/error, which must not go through a severity ladder).
• Every routine tool call becomes an alert. generic-json maps everything to OCSF class 2001 (Security Finding), which our promoter always promotes regardless of severity. One busy coding agent is an alert flood.
• detection.title/detection.summary, your ATT&CK technique ids and timestamp_utc are all unmapped — alerts render fallback titles, stamped at receipt time, with no techniques.

What shipped instead: a bundled agentmetry template (docs page source; it will render on the docs portal under Connectors → Agentmetry once the queued docs deploy finishes). One URL for both of your event kinds, split per event:

• Routine activity (tool_called, session_start, mcp_schema, …) lands at 6003 API Activity and stays in the lake for hunting — never auto-promoted.
• action.type: detection routes to 2001 and is always promoted, whatever the severity — your rule engine already judged the sequence, the same reasoning that promotes a SIEM notable. The ladder survives tier for tier (critical stays a distinct tier, never collapsed into high).
• Your ATT&CK technique ids (detection.technique_ids, tool.mitre.technique_id) are carried as supplied, never re-inferred, and marked verified only when our ATT&CK corpus confirms them. ATLAS ids are preserved in evidence fields and kept out of ATT&CK-typed fields — per your own ECS warning about AML.T**** ids corrupting technique rollups.
• Agentmetry-observed coding agents also feed our AI-estate inventory and entity graph, with the operator and host behind each one.

Setup is: mint an inbox URL with the Agentmetry template in the console, point AGENTMETRY_AUDIT_WEBHOOK_URL at it, and keep AGENTMETRY_AUDIT_WEBHOOK_FORMAT=canonical (the default) — the batch and cloudevents formats wrap the record in an envelope the template does not unwrap.

Verified vs not, stated plainly. Verified: real captured events through the real embedded template and registry — class routing, the full severity ladder, technique carry, malformed-event degradation, and the generic-json comparison above. Not verified: a live Agentmetry orchestrator POSTing to a live AiSOC deployment over the network; the docs page says exactly that rather than claiming it. Your stated non-coverage (browser chat, model providers, agents with hooks disabled; hook removal surfacing as a heartbeat change, not prevention) is quoted in the docs so nobody expects otherwise.

If a future schema release moves a field, the unmapped half degrades to template defaults rather than being dropped — a ping here or a PR against the template YAML is welcome when that happens.

Closing as resolved: the template, tests and docs are on main and will be in the next release.

[beenuar]

The docs deploy has finished — the page is live: https://beenuar.github.io/AiSOC/docs/connectors/agentmetry/

[blitzcrieg1]

Thank you. This is far more than I asked for, and better than what I would have written: splitting activity (6003) from detections (2001) is the right call, and I had not thought through what generic-json does to severity.

On schema stability: the canonical schema changes additively, so the fields you map (action.type, detection.severity, detection.technique_ids, tool.mitre, timestamp_utc) are not renamed or moved. If that ever has to change, I will ping this thread before it ships.

I'll link your connector page from Agentmetry's integration docs so people find it from both sides.

And if Cyble ever wants to compare notes on what coding agents actually do on real machines, I'd value 20 minutes.