GOV-14: SIEM export
In short: Send agent activity and policy decisions to the security team's SIEM in a structured format, close to real time. Agent events need to sit next to every other security signal. Detection rules and investigations fail when agent logs live in a separate console.
1GOV-14
What does GOV-14 require?
Send agent activity and policy decisions to the security team's SIEM in a structured format, close to real time.
Why does it matter?
Agent events need to sit next to every other security signal. Detection rules and investigations fail when agent logs live in a separate console.
How do you test it?
- Search the SIEM for a known agent action from today.
- Measure the delay between action and SIEM arrival.
- Confirm fields for agent, person and decision are parsed.
Which platforms document GOV-14?
Documented by Aembit and Clutch Security.
- 6.55Aembit documentedSource: Aembit IAM for Agentic AI is generally available, read
- 6.35Clutch Security documentedSource: Clutch Security platform, read
- 9.10NewCore not found in public materialChecked: NewCore: Discover; NewCore: Secure; NewCore: Govern; NewCore: Identity foundation; NewCore emerges from stealth; NewCore on AWS Marketplace, read
- 8.35Silverfort not found in public materialChecked: Silverfort: AI Agent Security; Silverfort unveils AI Agent Security; Silverfort and Google Cloud Agent Gateway; Silverfort pricing, read
- 7.30Astrix Security not found in public materialChecked: Astrix at RSAC 2026; Astrix product; Cisco and Astrix Security, read
- 7.30Cyera Identity not found in public materialChecked: Oasis Agentic Access Management; Cyera completes Oasis Security acquisition, read
- 6.85Descope not found in public materialChecked: Descope Agentic Identity Hub; Descope Agentic Identity Hub 3.0, read
- 6.55Token Security not found in public materialChecked: Token Security home, read
- 6.55SailPoint Entro not found in public materialChecked: SailPoint agentic AI security; SailPoint closes Entro Security acquisition, read
- 5.50Idira not found in public materialChecked: Palo Alto Networks introduces Idira; CyberArk Secure AI architecture docs; Palo Alto Networks completes CyberArk acquisition, read
Which framework references apply?
No framework mapping is confirmed for this control yet. See the framework crosswalks for what we checked.
Which controls are related?
Glossary: siem.
Reviewed by The Register desk