{"id":58851,"date":"2026-09-06T08:02:31","date_gmt":"2026-09-05T22:02:31","guid":{"rendered":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/09\/06\/wiring-ai-agent-telemetry-into-sentinel-to-detect-threats-early\/"},"modified":"2026-09-06T08:03:49","modified_gmt":"2026-09-05T22:03:49","slug":"wiring-ai-agent-telemetry-into-sentinel-to-detect-threats-early","status":"publish","type":"post","link":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/09\/06\/wiring-ai-agent-telemetry-into-sentinel-to-detect-threats-early\/","title":{"rendered":"Wiring AI Agent Telemetry into Sentinel to Detect Threats Early"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">In this blog post Wiring AI Agent Telemetry into Sentinel to Detect Threats Early we will explain how to turn everyday AI agent activity into useful security signals, helping your team detect risky behaviour before it becomes a serious incident.<\/p>\n\n\n\n<!--more-->\n\n\n\n<p class=\"wp-block-paragraph\">The problem is not usually that an AI agent suddenly \u201cgoes rogue\u201d. It is that a legitimate agent reads a malicious document, uses the wrong tool, accesses more information than expected or repeats an action hundreds of times before anyone notices.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Traditional monitoring may confirm that the application is online and responding quickly. It may not tell you that the agent attempted to export customer records, followed hidden instructions in an email or used a privileged identity outside its normal workflow.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What agent telemetry means in plain English<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Agent telemetry is the record of what an AI agent did during a task. It can show who started the request, which agent handled it, what information it accessed, which tools it called, what decisions were blocked and whether the task succeeded.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">OpenTelemetry provides a standard way to produce these records. Think of it as a common reporting format that lets different agents, models and business applications describe their activity consistently. Microsoft Agent Framework and Microsoft\u2019s current observability tools can use this standard to produce traces, logs and measurements for agent workflows.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Microsoft Sentinel is the security monitoring platform that analyses those records. Once agent activity reaches Sentinel, it can be compared with Microsoft Entra sign-ins, Microsoft Defender alerts, Azure activity and other security data to identify patterns that would be difficult to see in separate systems.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Our earlier guide to monitoring AI agent activity with Sentinel and OpenTelemetry covers the foundations. The next step is deciding which events matter, routing them reliably and creating detections that lead to action rather than another noisy dashboard.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">How the technology fits together<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">A practical architecture has four parts.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>The agent records important events.<\/strong> These include model requests, tool calls, data access, policy decisions, errors and task outcomes.<\/li>\n<li><strong>OpenTelemetry collects and labels the events.<\/strong> It connects each step using a trace or correlation identifier, allowing investigators to reconstruct the full task.<\/li>\n<li><strong>Azure Monitor receives and stores the data.<\/strong> A data collection rule controls the format, removes unnecessary fields and sends the records to the Log Analytics workspace used by Sentinel.<\/li>\n<li><strong>Sentinel looks for risky patterns.<\/strong> Detection rules create alerts and incidents, while automation can notify the right team or temporarily restrict an affected identity.<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">Azure Monitor\u2019s Logs Ingestion API can send custom JSON records into standard or custom Log Analytics tables. Data collection rules act as a gatekeeper, controlling the schema, destination and transformations applied before the information is stored.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Record decisions and actions, not every conversation<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">A common mistake is sending every prompt and complete AI response into the security platform. This increases storage costs and may create a new collection of sensitive personal, customer or commercial information.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Start with metadata that answers the questions an investigator will actually ask:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Which agent performed the action?<\/li>\n<li>Which user, service or agent started the task?<\/li>\n<li>Which tool was requested?<\/li>\n<li>What resource or data category was accessed?<\/li>\n<li>Was the action allowed, blocked or sent for approval?<\/li>\n<li>How many records, files or messages were involved?<\/li>\n<li>Did a security control detect prompt injection or unsafe content?<\/li>\n<li>Which trace identifier links the event to the full workflow?<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">A simplified event could look like this:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>{\n &quot;time&quot;: &quot;2026-09-05T02:18:24Z&quot;,\n &quot;agentId&quot;: &quot;service-desk-triage&quot;,\n &quot;runId&quot;: &quot;8fe2c921&quot;,\n &quot;initiatedBy&quot;: &quot;user-1842&quot;,\n &quot;eventType&quot;: &quot;tool.call&quot;,\n &quot;toolName&quot;: &quot;reset-user-password&quot;,\n &quot;targetResource&quot;: &quot;account-5521&quot;,\n &quot;actionRisk&quot;: &quot;high&quot;,\n &quot;approvalRequired&quot;: true,\n &quot;actionOutcome&quot;: &quot;blocked&quot;,\n &quot;promptInjectionDetected&quot;: true\n}<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">This tells the security team what happened without automatically storing the full conversation. If prompt content must be retained for investigation, access should be tightly restricted, retention should be limited and sensitive values should be masked.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Build detections around business impact<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Do not alert merely because an agent called a tool. Alert when the behaviour differs from what the business approved.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">1. A low-risk agent requests a privileged tool<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">A service desk triage agent may be allowed to classify and route tickets. It should not normally reset passwords, change group memberships or create administrator accounts.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If that agent requests a privileged tool, Sentinel should generate an alert even when the action is blocked. The attempt may reveal prompt injection, a configuration error or an unauthorised change to the agent.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">2. A normal task suddenly accesses unusual volumes of data<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">An agent that usually reads one customer record but suddenly queries 5,000 records may be malfunctioning or being manipulated. Monitoring the volume and sensitivity of accessed information helps detect possible data theft before the information leaves the environment.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">3. Prompt injection is followed by a tool request<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Prompt injection occurs when malicious instructions are hidden inside content such as an email, document or webpage. The attacker is attempting to make the agent ignore its approved instructions and perform an unintended action.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The strongest alert is not simply \u201csuspicious text found\u201d. It is a chain of events: suspicious content was detected, the agent changed direction and then requested a sensitive tool. Microsoft\u2019s AI security guidance treats indirect prompt injection as a key threat because agents increasingly process untrusted external content.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">4. The agent identity behaves differently<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Agent activity should be correlated with Microsoft Entra ID, which manages identities and access to company systems. Watch for access from an unexpected location, repeated authentication failures, newly granted permissions or activity outside the agent\u2019s normal resources.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This builds on the identity controls discussed in securing agent-to-agent communication with Microsoft Entra ID. Authentication establishes who the agent is. Telemetry helps confirm that it continues behaving as expected.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">A practical Sentinel detection<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Sentinel uses Kusto Query Language, usually called KQL, to search security records. The following simplified rule identifies high-risk or unapproved tool calls:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>let ApprovedTools = dynamic([\n &quot;search-knowledge&quot;,\n &quot;classify-ticket&quot;,\n &quot;create-ticket&quot;\n]);\nAgentTelemetry_CL\n| where TimeGenerated &amp;gt; ago(15m)\n| where EventType == &quot;tool.call&quot;\n| where ToolName !in (ApprovedTools)\n or ActionRisk in (&quot;high&quot;, &quot;critical&quot;)\n| summarize\n CallCount = count(),\n Users = make_set(InitiatedBy, 20),\n Targets = make_set(TargetResource, 20),\n FirstSeen = min(TimeGenerated),\n LastSeen = max(TimeGenerated)\n by AgentId, ToolName, ActionRisk\n| where CallCount &amp;gt;= 3\n or ActionRisk == &quot;critical&quot;<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The exact thresholds should reflect the agent\u2019s purpose. A payroll agent, customer service agent and software development agent will have very different normal behaviour.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Turn alerts into a response process<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Detection is only valuable when someone owns the response. As we discussed in The Defender Alerts Nobody Looked At Until It Was Too Late, many incidents grow because an existing warning was never reviewed.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For every agent rule, document who receives the alert, how quickly it must be reviewed and which actions are safe to automate. A medium-risk event might create a service desk ticket. A critical event could disable a tool connection, revoke an agent credential and notify the security team.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Microsoft Defender can also detect suspicious agent behaviour, including prompt injection, credential leakage and malicious tool use for supported agent platforms. Sentinel remains valuable as the correlation layer that combines these detections with identity, endpoint, cloud and business application evidence. Some newer agent protection capabilities remain in preview, so they should be tested and governed rather than assumed to cover every agent automatically.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">A realistic business scenario<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Consider a 200-person professional services firm using an agent to summarise client emails and create follow-up tasks. A malicious instruction is hidden in an attached document and tells the agent to search previous correspondence and send the results externally.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Without connected telemetry, the email system, agent platform and identity logs each show only part of the story. With Sentinel correlation, the firm can see the suspicious document assessment, unusual search volume, external tool request and agent identity involved in one incident.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The business outcome is faster containment, less investigation time and a much smaller chance of a reportable data breach.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Start with one agent and five useful detections<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">You do not need to monitor every possible event on day one. Choose one production agent, define its approved tools and data boundaries, then implement five high-value detections covering prompt injection, privileged tool use, abnormal data volume, identity anomalies and repeated failures.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This approach also supports Australian governance expectations. Agent telemetry does not replace the Essential Eight, the Australian Government\u2019s baseline cybersecurity framework, but it can strengthen monitoring, incident response and evidence around the use of privileged systems.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">CloudProInc brings more than 20 years of enterprise IT experience to this work. As a Melbourne-based Microsoft Partner and Wiz Security Integrator, we help organisations connect Azure, Microsoft 365, Defender, Sentinel, OpenAI and Claude into practical controls that security teams can operate.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If you are deploying agents but cannot clearly see what they access, which tools they use or who will respond when something looks wrong, we are happy to review the setup with you\u2014no strings attached.<\/p>\n\n\n","protected":false},"excerpt":{"rendered":"<p>Connect AI agent activity to Microsoft Sentinel so risky tool use, prompt injection and unusual data access stand out before a small anomaly becomes a costly incident.<\/p>\n","protected":false},"author":1,"featured_media":58853,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_yoast_wpseo_opengraph-title":"AI Agent Telemetry: Detect Threats Earlier","_yoast_wpseo_opengraph-description":"AI agent telemetry turns tool calls, data access and policy decisions into security signals, helping teams spot threats and respond before incidents grow.","_yoast_wpseo_twitter-title":"AI Agent Telemetry: Detect Threats Earlier","_yoast_wpseo_twitter-description":"AI agent telemetry turns tool calls, data access and policy decisions into security signals, helping teams spot threats and respond before incidents grow.","_et_pb_use_builder":"","_et_pb_old_content":"","_et_gb_content_width":"","_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[80,21,13,107],"tags":[],"class_list":["post-58851","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ai-agents","category-azure-monitor","category-blog","category-cybersecurity"],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v27.3 (Yoast SEO v28.4) - https:\/\/yoast.com\/product\/yoast-seo-premium-wordpress\/ -->\n<title>AI Agent Telemetry: Detect Threats Earlier<\/title>\n<meta name=\"description\" content=\"AI agent telemetry turns tool calls, data access and policy decisions into security signals, helping teams spot threats and respond before incidents grow.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/09\/06\/wiring-ai-agent-telemetry-into-sentinel-to-detect-threats-early\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"AI Agent Telemetry: Detect Threats Earlier\" \/>\n<meta property=\"og:description\" content=\"AI agent telemetry turns tool calls, data access and policy decisions into security signals, helping teams spot threats and respond before incidents grow.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/09\/06\/wiring-ai-agent-telemetry-into-sentinel-to-detect-threats-early\/\" \/>\n<meta property=\"og:site_name\" content=\"CPI Consulting\" \/>\n<meta property=\"article:published_time\" content=\"2026-09-05T22:02:31+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-09-05T22:03:49+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.cloudproinc.com.au\/wp-content\/uploads\/2026\/09\/wiring-ai-agent-telemetry-into-sentinel-to-detect-threats-early.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1536\" \/>\n\t<meta property=\"og:image:height\" content=\"1024\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"CPI Staff\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:title\" content=\"AI Agent Telemetry: Detect Threats Earlier\" \/>\n<meta name=\"twitter:description\" content=\"AI agent telemetry turns tool calls, data access and policy decisions into security signals, helping teams spot threats and respond before incidents grow.\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"CPI Staff\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"8 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.cloudproinc.com.au\\\/index.php\\\/2026\\\/09\\\/06\\\/wiring-ai-agent-telemetry-into-sentinel-to-detect-threats-early\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.cloudproinc.com.au\\\/index.php\\\/2026\\\/09\\\/06\\\/wiring-ai-agent-telemetry-into-sentinel-to-detect-threats-early\\\/\"},\"author\":{\"name\":\"CPI Staff\",\"@id\":\"https:\\\/\\\/www.cloudproinc.com.au\\\/#\\\/schema\\\/person\\\/192eeeb0ce91062126ce3822ae88fe6e\"},\"headline\":\"Wiring AI Agent Telemetry into Sentinel to Detect Threats Early\",\"datePublished\":\"2026-09-05T22:02:31+00:00\",\"dateModified\":\"2026-09-05T22:03:49+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.cloudproinc.com.au\\\/index.php\\\/2026\\\/09\\\/06\\\/wiring-ai-agent-telemetry-into-sentinel-to-detect-threats-early\\\/\"},\"wordCount\":1383,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/www.cloudproinc.com.au\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.cloudproinc.com.au\\\/index.php\\\/2026\\\/09\\\/06\\\/wiring-ai-agent-telemetry-into-sentinel-to-detect-threats-early\\\/#primaryimage\"},\"thumbnailUrl\":\"\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/wiring-ai-agent-telemetry-into-sentinel-to-detect-threats-early.png\",\"articleSection\":[\"AI Agents\",\"Azure Monitor\",\"Blog\",\"Cybersecurity\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/www.cloudproinc.com.au\\\/index.php\\\/2026\\\/09\\\/06\\\/wiring-ai-agent-telemetry-into-sentinel-to-detect-threats-early\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.cloudproinc.com.au\\\/index.php\\\/2026\\\/09\\\/06\\\/wiring-ai-agent-telemetry-into-sentinel-to-detect-threats-early\\\/\",\"url\":\"https:\\\/\\\/www.cloudproinc.com.au\\\/index.php\\\/2026\\\/09\\\/06\\\/wiring-ai-agent-telemetry-into-sentinel-to-detect-threats-early\\\/\",\"name\":\"AI Agent Telemetry: Detect Threats Earlier\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.cloudproinc.com.au\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.cloudproinc.com.au\\\/index.php\\\/2026\\\/09\\\/06\\\/wiring-ai-agent-telemetry-into-sentinel-to-detect-threats-early\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.cloudproinc.com.au\\\/index.php\\\/2026\\\/09\\\/06\\\/wiring-ai-agent-telemetry-into-sentinel-to-detect-threats-early\\\/#primaryimage\"},\"thumbnailUrl\":\"\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/wiring-ai-agent-telemetry-into-sentinel-to-detect-threats-early.png\",\"datePublished\":\"2026-09-05T22:02:31+00:00\",\"dateModified\":\"2026-09-05T22:03:49+00:00\",\"description\":\"AI agent telemetry turns tool calls, data access and policy decisions into security signals, helping teams spot threats and respond before incidents grow.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.cloudproinc.com.au\\\/index.php\\\/2026\\\/09\\\/06\\\/wiring-ai-agent-telemetry-into-sentinel-to-detect-threats-early\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.cloudproinc.com.au\\\/index.php\\\/2026\\\/09\\\/06\\\/wiring-ai-agent-telemetry-into-sentinel-to-detect-threats-early\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.cloudproinc.com.au\\\/index.php\\\/2026\\\/09\\\/06\\\/wiring-ai-agent-telemetry-into-sentinel-to-detect-threats-early\\\/#primaryimage\",\"url\":\"\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/wiring-ai-agent-telemetry-into-sentinel-to-detect-threats-early.png\",\"contentUrl\":\"\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/wiring-ai-agent-telemetry-into-sentinel-to-detect-threats-early.png\",\"width\":1536,\"height\":1024},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.cloudproinc.com.au\\\/index.php\\\/2026\\\/09\\\/06\\\/wiring-ai-agent-telemetry-into-sentinel-to-detect-threats-early\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.cloudproinc.com.au\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Wiring AI Agent Telemetry into Sentinel to Detect Threats Early\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.cloudproinc.com.au\\\/#website\",\"url\":\"https:\\\/\\\/www.cloudproinc.com.au\\\/\",\"name\":\"Cloud Pro Inc - CPI Consulting Pty Ltd\",\"description\":\"Cloud, AI &amp; Cybersecurity Consulting | Melbourne\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.cloudproinc.com.au\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.cloudproinc.com.au\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.cloudproinc.com.au\\\/#organization\",\"name\":\"Cloud Pro Inc - Cloud Pro Inc - CPI Consulting Pty Ltd\",\"url\":\"https:\\\/\\\/www.cloudproinc.com.au\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.cloudproinc.com.au\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"\\\/wp-content\\\/uploads\\\/2022\\\/01\\\/favfinalfile.png\",\"contentUrl\":\"\\\/wp-content\\\/uploads\\\/2022\\\/01\\\/favfinalfile.png\",\"width\":500,\"height\":500,\"caption\":\"Cloud Pro Inc - Cloud Pro Inc - CPI Consulting Pty Ltd\"},\"image\":{\"@id\":\"https:\\\/\\\/www.cloudproinc.com.au\\\/#\\\/schema\\\/logo\\\/image\\\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.cloudproinc.com.au\\\/#\\\/schema\\\/person\\\/192eeeb0ce91062126ce3822ae88fe6e\",\"name\":\"CPI Staff\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/2d96eeb53b791d92c8c50dd667e3beec92c93253bb6ff21c02cfa8ca73665c70?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/2d96eeb53b791d92c8c50dd667e3beec92c93253bb6ff21c02cfa8ca73665c70?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/2d96eeb53b791d92c8c50dd667e3beec92c93253bb6ff21c02cfa8ca73665c70?s=96&d=mm&r=g\",\"caption\":\"CPI Staff\"},\"sameAs\":[\"http:\\\/\\\/www.cloudproinc.com.au\"],\"url\":\"https:\\\/\\\/www.cloudproinc.com.au\\\/index.php\\\/author\\\/cpiadmin\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"AI Agent Telemetry: Detect Threats Earlier","description":"AI agent telemetry turns tool calls, data access and policy decisions into security signals, helping teams spot threats and respond before incidents grow.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/09\/06\/wiring-ai-agent-telemetry-into-sentinel-to-detect-threats-early\/","og_locale":"en_US","og_type":"article","og_title":"AI Agent Telemetry: Detect Threats Earlier","og_description":"AI agent telemetry turns tool calls, data access and policy decisions into security signals, helping teams spot threats and respond before incidents grow.","og_url":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/09\/06\/wiring-ai-agent-telemetry-into-sentinel-to-detect-threats-early\/","og_site_name":"CPI Consulting","article_published_time":"2026-09-05T22:02:31+00:00","article_modified_time":"2026-09-05T22:03:49+00:00","og_image":[{"width":1536,"height":1024,"url":"https:\/\/www.cloudproinc.com.au\/wp-content\/uploads\/2026\/09\/wiring-ai-agent-telemetry-into-sentinel-to-detect-threats-early.png","type":"image\/png"}],"author":"CPI Staff","twitter_card":"summary_large_image","twitter_title":"AI Agent Telemetry: Detect Threats Earlier","twitter_description":"AI agent telemetry turns tool calls, data access and policy decisions into security signals, helping teams spot threats and respond before incidents grow.","twitter_misc":{"Written by":"CPI Staff","Est. reading time":"8 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/09\/06\/wiring-ai-agent-telemetry-into-sentinel-to-detect-threats-early\/#article","isPartOf":{"@id":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/09\/06\/wiring-ai-agent-telemetry-into-sentinel-to-detect-threats-early\/"},"author":{"name":"CPI Staff","@id":"https:\/\/www.cloudproinc.com.au\/#\/schema\/person\/192eeeb0ce91062126ce3822ae88fe6e"},"headline":"Wiring AI Agent Telemetry into Sentinel to Detect Threats Early","datePublished":"2026-09-05T22:02:31+00:00","dateModified":"2026-09-05T22:03:49+00:00","mainEntityOfPage":{"@id":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/09\/06\/wiring-ai-agent-telemetry-into-sentinel-to-detect-threats-early\/"},"wordCount":1383,"commentCount":0,"publisher":{"@id":"https:\/\/www.cloudproinc.com.au\/#organization"},"image":{"@id":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/09\/06\/wiring-ai-agent-telemetry-into-sentinel-to-detect-threats-early\/#primaryimage"},"thumbnailUrl":"\/wp-content\/uploads\/2026\/09\/wiring-ai-agent-telemetry-into-sentinel-to-detect-threats-early.png","articleSection":["AI Agents","Azure Monitor","Blog","Cybersecurity"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.cloudproinc.com.au\/index.php\/2026\/09\/06\/wiring-ai-agent-telemetry-into-sentinel-to-detect-threats-early\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/09\/06\/wiring-ai-agent-telemetry-into-sentinel-to-detect-threats-early\/","url":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/09\/06\/wiring-ai-agent-telemetry-into-sentinel-to-detect-threats-early\/","name":"AI Agent Telemetry: Detect Threats Earlier","isPartOf":{"@id":"https:\/\/www.cloudproinc.com.au\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/09\/06\/wiring-ai-agent-telemetry-into-sentinel-to-detect-threats-early\/#primaryimage"},"image":{"@id":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/09\/06\/wiring-ai-agent-telemetry-into-sentinel-to-detect-threats-early\/#primaryimage"},"thumbnailUrl":"\/wp-content\/uploads\/2026\/09\/wiring-ai-agent-telemetry-into-sentinel-to-detect-threats-early.png","datePublished":"2026-09-05T22:02:31+00:00","dateModified":"2026-09-05T22:03:49+00:00","description":"AI agent telemetry turns tool calls, data access and policy decisions into security signals, helping teams spot threats and respond before incidents grow.","breadcrumb":{"@id":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/09\/06\/wiring-ai-agent-telemetry-into-sentinel-to-detect-threats-early\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.cloudproinc.com.au\/index.php\/2026\/09\/06\/wiring-ai-agent-telemetry-into-sentinel-to-detect-threats-early\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/09\/06\/wiring-ai-agent-telemetry-into-sentinel-to-detect-threats-early\/#primaryimage","url":"\/wp-content\/uploads\/2026\/09\/wiring-ai-agent-telemetry-into-sentinel-to-detect-threats-early.png","contentUrl":"\/wp-content\/uploads\/2026\/09\/wiring-ai-agent-telemetry-into-sentinel-to-detect-threats-early.png","width":1536,"height":1024},{"@type":"BreadcrumbList","@id":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/09\/06\/wiring-ai-agent-telemetry-into-sentinel-to-detect-threats-early\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.cloudproinc.com.au\/"},{"@type":"ListItem","position":2,"name":"Wiring AI Agent Telemetry into Sentinel to Detect Threats Early"}]},{"@type":"WebSite","@id":"https:\/\/www.cloudproinc.com.au\/#website","url":"https:\/\/www.cloudproinc.com.au\/","name":"Cloud Pro Inc - CPI Consulting Pty Ltd","description":"Cloud, AI &amp; Cybersecurity Consulting | Melbourne","publisher":{"@id":"https:\/\/www.cloudproinc.com.au\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.cloudproinc.com.au\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.cloudproinc.com.au\/#organization","name":"Cloud Pro Inc - Cloud Pro Inc - CPI Consulting Pty Ltd","url":"https:\/\/www.cloudproinc.com.au\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.cloudproinc.com.au\/#\/schema\/logo\/image\/","url":"\/wp-content\/uploads\/2022\/01\/favfinalfile.png","contentUrl":"\/wp-content\/uploads\/2022\/01\/favfinalfile.png","width":500,"height":500,"caption":"Cloud Pro Inc - Cloud Pro Inc - CPI Consulting Pty Ltd"},"image":{"@id":"https:\/\/www.cloudproinc.com.au\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/www.cloudproinc.com.au\/#\/schema\/person\/192eeeb0ce91062126ce3822ae88fe6e","name":"CPI Staff","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/2d96eeb53b791d92c8c50dd667e3beec92c93253bb6ff21c02cfa8ca73665c70?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/2d96eeb53b791d92c8c50dd667e3beec92c93253bb6ff21c02cfa8ca73665c70?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/2d96eeb53b791d92c8c50dd667e3beec92c93253bb6ff21c02cfa8ca73665c70?s=96&d=mm&r=g","caption":"CPI Staff"},"sameAs":["http:\/\/www.cloudproinc.com.au"],"url":"https:\/\/www.cloudproinc.com.au\/index.php\/author\/cpiadmin\/"}]}},"jetpack-related-posts":[{"id":58230,"url":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/08\/03\/monitoring-ai-agent-activity-with-sentinel-and-opentelemetry\/","url_meta":{"origin":58851,"position":0},"title":"Monitoring AI Agent Activity with Sentinel and OpenTelemetry","author":"CPI Staff","date":"August 3, 2026","format":false,"excerpt":"Learn how Microsoft Sentinel and OpenTelemetry can reveal risky AI agent behaviour, control costs and give leaders a clear audit trail without collecting unnecessary sensitive data.","rel":"","context":"In &quot;AI Agents&quot;","block_context":{"text":"AI Agents","link":"https:\/\/www.cloudproinc.com.au\/index.php\/category\/ai-agents\/"},"img":{"alt_text":"","src":"\/wp-content\/uploads\/2026\/08\/monitoring-ai-agent-activity-with-sentinel-and-opentelemetry.png","width":350,"height":200,"srcset":"\/wp-content\/uploads\/2026\/08\/monitoring-ai-agent-activity-with-sentinel-and-opentelemetry.png 1x, \/wp-content\/uploads\/2026\/08\/monitoring-ai-agent-activity-with-sentinel-and-opentelemetry.png 1.5x, \/wp-content\/uploads\/2026\/08\/monitoring-ai-agent-activity-with-sentinel-and-opentelemetry.png 2x, \/wp-content\/uploads\/2026\/08\/monitoring-ai-agent-activity-with-sentinel-and-opentelemetry.png 3x, \/wp-content\/uploads\/2026\/08\/monitoring-ai-agent-activity-with-sentinel-and-opentelemetry.png 4x"},"classes":[]},{"id":57880,"url":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/07\/16\/monitoring-claude-code-and-agent-activity-with-opentelemetry\/","url_meta":{"origin":58851,"position":1},"title":"Monitoring Claude Code and Agent Activity With OpenTelemetry","author":"CPI Staff","date":"July 16, 2026","format":false,"excerpt":"Claude Code can move fast, but leaders need visibility. Here is how OpenTelemetry helps monitor cost, risk, productivity, and agent behaviour without slowing teams down.","rel":"","context":"In &quot;AI Coding Agents&quot;","block_context":{"text":"AI Coding Agents","link":"https:\/\/www.cloudproinc.com.au\/index.php\/category\/ai-coding-agents\/"},"img":{"alt_text":"","src":"\/wp-content\/uploads\/2026\/07\/monitoring-claude-code-and-agent-activity-with-opentelemetry.png","width":350,"height":200,"srcset":"\/wp-content\/uploads\/2026\/07\/monitoring-claude-code-and-agent-activity-with-opentelemetry.png 1x, \/wp-content\/uploads\/2026\/07\/monitoring-claude-code-and-agent-activity-with-opentelemetry.png 1.5x, \/wp-content\/uploads\/2026\/07\/monitoring-claude-code-and-agent-activity-with-opentelemetry.png 2x, \/wp-content\/uploads\/2026\/07\/monitoring-claude-code-and-agent-activity-with-opentelemetry.png 3x, \/wp-content\/uploads\/2026\/07\/monitoring-claude-code-and-agent-activity-with-opentelemetry.png 4x"},"classes":[]},{"id":57389,"url":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/04\/02\/anthropics-claude-code-leak-just-changed-the-business-case-for-ai-coding-tools\/","url_meta":{"origin":58851,"position":2},"title":"Anthropic&#8217;s Claude Code Leak Just Changed the Business Case for AI Coding Tools","author":"CPI Staff","date":"April 2, 2026","format":false,"excerpt":"The immediate story was easy to misunderstand. On April 1-2 2026, Anthropic confirmed that a Claude Code release packaging issue was caused by human error, not a security breach. Anthropic also said no customer data or credentials were exposed. That matters. But the more important business lesson sits elsewhere. AI\u2026","rel":"","context":"In &quot;AI&quot;","block_context":{"text":"AI","link":"https:\/\/www.cloudproinc.com.au\/index.php\/category\/ai\/"},"img":{"alt_text":"","src":"\/wp-content\/uploads\/2026\/04\/anthropics-claude-code-leak-business-case-ai-coding-cover.png","width":350,"height":200,"srcset":"\/wp-content\/uploads\/2026\/04\/anthropics-claude-code-leak-business-case-ai-coding-cover.png 1x, \/wp-content\/uploads\/2026\/04\/anthropics-claude-code-leak-business-case-ai-coding-cover.png 1.5x, \/wp-content\/uploads\/2026\/04\/anthropics-claude-code-leak-business-case-ai-coding-cover.png 2x, \/wp-content\/uploads\/2026\/04\/anthropics-claude-code-leak-business-case-ai-coding-cover.png 3x, \/wp-content\/uploads\/2026\/04\/anthropics-claude-code-leak-business-case-ai-coding-cover.png 4x"},"classes":[]},{"id":58608,"url":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/08\/23\/plan-sap-security-on-azure-before-the-sentinel-agent-retirement\/","url_meta":{"origin":58851,"position":3},"title":"Plan SAP Security on Azure Before the Sentinel Agent Retirement","author":"CPI Staff","date":"August 23, 2026","format":false,"excerpt":"Microsoft will disable the containerised Sentinel SAP connector on 14 September 2026. Learn how to migrate without losing security visibility or creating avoidable cost.","rel":"","context":"In &quot;Azure Security&quot;","block_context":{"text":"Azure Security","link":"https:\/\/www.cloudproinc.com.au\/index.php\/category\/azure-security\/"},"img":{"alt_text":"","src":"\/wp-content\/uploads\/2026\/08\/plan-sap-security-on-azure-before-the-sentinel-agent-retirement.png","width":350,"height":200,"srcset":"\/wp-content\/uploads\/2026\/08\/plan-sap-security-on-azure-before-the-sentinel-agent-retirement.png 1x, \/wp-content\/uploads\/2026\/08\/plan-sap-security-on-azure-before-the-sentinel-agent-retirement.png 1.5x, \/wp-content\/uploads\/2026\/08\/plan-sap-security-on-azure-before-the-sentinel-agent-retirement.png 2x, \/wp-content\/uploads\/2026\/08\/plan-sap-security-on-azure-before-the-sentinel-agent-retirement.png 3x, \/wp-content\/uploads\/2026\/08\/plan-sap-security-on-azure-before-the-sentinel-agent-retirement.png 4x"},"classes":[]},{"id":58777,"url":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/09\/03\/microsoft-purview-for-ai-agents-labels-dlp-and-audit-controls\/","url_meta":{"origin":58851,"position":4},"title":"Microsoft Purview for AI Agents Labels DLP and Audit Controls","author":"CPI Staff","date":"September 3, 2026","format":false,"excerpt":"Learn how Purview extends data labels, leak prevention and audit controls to AI agents, reducing risk without stopping useful automation.","rel":"","context":"In &quot;AI Agents&quot;","block_context":{"text":"AI Agents","link":"https:\/\/www.cloudproinc.com.au\/index.php\/category\/ai-agents\/"},"img":{"alt_text":"","src":"\/wp-content\/uploads\/2026\/09\/microsoft-purview-for-ai-agents-labels-dlp-and-audit-controls.png","width":350,"height":200,"srcset":"\/wp-content\/uploads\/2026\/09\/microsoft-purview-for-ai-agents-labels-dlp-and-audit-controls.png 1x, \/wp-content\/uploads\/2026\/09\/microsoft-purview-for-ai-agents-labels-dlp-and-audit-controls.png 1.5x, \/wp-content\/uploads\/2026\/09\/microsoft-purview-for-ai-agents-labels-dlp-and-audit-controls.png 2x, \/wp-content\/uploads\/2026\/09\/microsoft-purview-for-ai-agents-labels-dlp-and-audit-controls.png 3x, \/wp-content\/uploads\/2026\/09\/microsoft-purview-for-ai-agents-labels-dlp-and-audit-controls.png 4x"},"classes":[]},{"id":58254,"url":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/08\/04\/how-to-monitor-ai-applications-after-deployment-without-guesswork\/","url_meta":{"origin":58851,"position":5},"title":"How to Monitor AI Applications After Deployment Without Guesswork","author":"CPI Staff","date":"August 4, 2026","format":false,"excerpt":"AI monitoring must cover more than uptime. Learn how to track quality, cost, security and business value so deployed AI remains useful, safe and financially controlled.","rel":"","context":"In &quot;AI for Business &amp; AI Strategy&quot;","block_context":{"text":"AI for Business &amp; AI Strategy","link":"https:\/\/www.cloudproinc.com.au\/index.php\/category\/ai-for-business-ai-strategy\/"},"img":{"alt_text":"","src":"\/wp-content\/uploads\/2026\/08\/how-to-monitor-ai-applications-after-deployment-without-guesswork.png","width":350,"height":200,"srcset":"\/wp-content\/uploads\/2026\/08\/how-to-monitor-ai-applications-after-deployment-without-guesswork.png 1x, \/wp-content\/uploads\/2026\/08\/how-to-monitor-ai-applications-after-deployment-without-guesswork.png 1.5x, \/wp-content\/uploads\/2026\/08\/how-to-monitor-ai-applications-after-deployment-without-guesswork.png 2x, \/wp-content\/uploads\/2026\/08\/how-to-monitor-ai-applications-after-deployment-without-guesswork.png 3x, \/wp-content\/uploads\/2026\/08\/how-to-monitor-ai-applications-after-deployment-without-guesswork.png 4x"},"classes":[]}],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"\/wp-content\/uploads\/2026\/09\/wiring-ai-agent-telemetry-into-sentinel-to-detect-threats-early.png","_links":{"self":[{"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/posts\/58851","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/comments?post=58851"}],"version-history":[{"count":1,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/posts\/58851\/revisions"}],"predecessor-version":[{"id":58852,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/posts\/58851\/revisions\/58852"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/media\/58853"}],"wp:attachment":[{"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/media?parent=58851"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/categories?post=58851"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/tags?post=58851"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}