{"id":"IDR-004","section":"AI Detection & Response","requirement":"Integrate with SIEM, SOAR, ticketing, and identity systems","acceptance":"Use webhooks or APIs to consume relevant employee identity context and to push alerts into logging and response systems.","tier":"AT0–AT4","whyItMatters":"Security alerts need relevant context and need to stream to centralized repositories.","verificationMethod":"LT","verificationTest":"Pilot events can be enriched with employee identity context and streamed to your SIEM.","formerly":"GOV-003","alsoIn":[],"sort":35,"adoptionContext":"Operational integration with security, identity and service-management systems is a cross-tier governance capability.","mappings":[{"frameworks":["csf","soc2"],"explanation":"Structured webhooks and APIs can route adverse-event evidence into authorized staff’s monitoring, triage and incident-response workflows. A connector contributes only when delivery, ingestion, successful processing and the associated operational workflow are configured and exercised; it does not itself establish incident decisions or response ownership.","kind":"framework","references":{"csf":["DE.AE-06"],"soc2":["CC7.3","CC7.4"]},"relation":null,"conditions":[]},{"frameworks":["rmf"],"explanation":"Feeding AI events into enterprise incident, ticket and evidence workflows enables organizational information sharing about AI issues. The connected teams still need to operate the associated reporting and response practices.","kind":"framework","references":{"rmf":["GOVERN 4.3"]},"relation":null,"conditions":[]},{"frameworks":["iso27001"],"explanation":"Structured telemetry and incident-ticket integration supply logging, analysis and event-triage inputs. Demonstrate delivery, ingestion, successful processing, correlation and triage routing. An endpoint alone does not establish incident decisions, response ownership or completed response.","kind":"framework","references":{"iso27001":["A.5.25","A.8.15"]},"relation":null,"conditions":[]}],"area":"AI Detection & Response","areaSlug":"AIDR","url":"/r/IDR-004","frameworkRefs":{"ISO27001":["A.5.25","A.8.15"],"NIST-CSF":["DE.AE-06"],"NIST-AI-RMF":["GOVERN 4.3"],"SOC2":["CC7.3","CC7.4"]}}