Listen to this Post
Introduction:
Local AI assistants such as Claude Code, Copilot Chat, and Cowork are rapidly being adopted by developers, yet they create a massive blind spot in enterprise security monitoring. Unlike cloud-based AI services, these tools run directly on endpoints, generating logs that rarely reach central SIEM or SOAR platforms. This article shows how to use OpenTelemetry (OTel) to capture and ship local AI telemetry to Azure Monitor and Microsoft Sentinel, closing that gap with a practical proof of concept.
Learning Objectives:
– Identify the security risks and monitoring gaps introduced by local AI coding agents.
– Deploy an OpenTelemetry collector to ingest logs from developer endpoints and forward them to Azure Monitor.
– Configure a pipeline to send OTel data to Microsoft Sentinel for correlation, alerting, and incident response.
You Should Know:
1. Why Local AI Usage is a Blind Spot in Your Security Stack
Enterprise monitoring often focuses on network egress, cloud APIs, and endpoint EDR. However, tools like Claude Code’s Cowork or VSCode Copilot Chat generate sensitive activity logs locally. Claude Enterprise provides some compliance API visibility, but Cowork activity does not appear in that API — a hole likely to persist until vendors standardize telemetry. Attackers with local access could manipulate or exfiltrate AI prompts, code suggestions, or internal conversation histories without triggering traditional alerts. OpenTelemetry offers a vendor-agnostic way to collect, process, and export these logs before they vanish.
Step‑by‑step guide:
1. Identify all local AI tools running in your environment (e.g., `ps aux | grep -E “claude|copilot|cowork”` on Linux; `Get-Process | Where-Object {$_.ProcessName -like “copilot”}` in PowerShell).
2. Understand that many of these tools write JSON logs to local directories (e.g., `~/.config/Code/logs` for VSCode).
3. Decide which log sources require collection — typical candidates include `output.log`, `telemetry.json`, or extension-specific logs.
2. Setting Up an OpenTelemetry Collector for AI Telemetry
The OTel collector acts as a lightweight agent that receives logs from file tails or local HTTP endpoints, processes them (e.g., redact secrets, add metadata), and exports to a backend. Below is a minimal `otel-collector-config.yaml` that tails JSON log files and forwards to Azure Monitor.
receivers: filelog: include: [ /var/log/ai-agents/.json ] operators: - type: json_parser timestamp: parse_from: attributes.time layout: "%Y-%m-%dT%H:%M:%S.%fZ" exporters: azuremonitor: instrumentation_key: "YOUR_INSTRUMENTATION_KEY" endpoint: "https://dc.services.visualstudio.com/v2/track" service: pipelines: logs: receivers: [bash] exporters: [bash]
Step‑by‑step guide:
1. Install the OTel collector on a developer VM or central log aggregator:
wget https://github.com/open-telemetry/opentelemetry-collector-releases/releases/download/v0.108.0/otelcol_0.108.0_linux_amd64.tar.gz tar -xzf otelcol_.tar.gz sudo mv otelcol /usr/local/bin/
2. Create the configuration file from the example above and replace the instrumentation key.
3. Run the collector: `otelcol –config otel-collector-config.yaml`
4. Test with a dummy log: `echo ‘{“time”:”2025-03-15T10:00:00Z”,”message”:”Copilot suggestion”,”user”:”dev1″}’ > /var/log/ai-agents/test.json`
5. Verify logs appear in Application Insights under “Traces”.
3. Shipping Logs to Azure Monitor (Application Insights)
Application Insights is part of Azure Monitor and can ingest OTel logs natively. You need an Application Insights resource and its instrumentation key (or connection string). For production, prefer managed identity over keys.
Step‑by‑step guide (Windows & Linux):
– Azure CLI (Linux/macOS/WSL):
az monitor app-insights component show --resource-group <RG> --1ame <AI-1AME> --query connectionString -o tsv
– PowerShell (Windows):
$key = (Get-AzApplicationInsights -ResourceGroupName <RG> -1ame <AI-1AME>).InstrumentationKey
– Update the collector config: replace `instrumentation_key` with your key.
– Restart the collector and watch for export success logs.
– In Azure portal, navigate to your Application Insights → Logs → run a query:
traces | where message contains "Copilot" | take 10
4. Forwarding to Microsoft Sentinel for SOAR Integration
If you already use Microsoft Sentinel, you can configure the OTel collector to send logs directly to a Log Analytics workspace linked to Sentinel. The exporter changes to `azuremonitor` with a workspace ID/key, or use the `otlphttp` exporter if Sentinel supports OTLP (currently preview). Alternatively, have Application Insights continuous export forward to Log Analytics.
Step‑by‑step guide:
1. Create a Log Analytics workspace and enable Sentinel.
2. Get the workspace ID and primary key from Azure portal → Log Analytics workspace → Agents management.
3. Modify the exporter section in `otel-collector-config.yaml`:
exporters: azuremonitor: endpoint: "https://<YOUR_REGION>.in.applicationinsights.azure.com/v2/track" instrumentation_key: "" leave empty if using connection string connection_string: "InstrumentationKey=...;IngestionEndpoint=https://..."
For direct Log Analytics ingestion, use the `loganalytics` exporter (community supported) or the OTLP HTTP exporter with the Log Analytics gateway.
4. After logs arrive in Sentinel, create a scheduled analytics rule:
AI_CLI_Logs_CL | where Message contains "sensitive_data" | extend User = tostring(parse_json(Message).user) | project TimeGenerated, User, Message, SourceIP
5. Set alerts for excessive AI usage patterns (e.g., >100 queries per minute from a single host).
5. Hands-On: Deploy the PoC from GitHub
The author’s repo `https://github.com/lnfernux/OTEL2Sentinel` provides a quick PoC container that acts as an OTel collector, forwarding to Sentinel via Azure Monitor. Use this only for dev/test.
Step‑by‑step guide:
1. Clone the repository:
git clone https://github.com/lnfernux/OTEL2Sentinel.git cd OTEL2Sentinel
2. Edit `config.yaml` to add your Application Insights instrumentation key.
3. Run the collector with Docker:
docker run -v $(pwd)/config.yaml:/etc/otelcol/config.yaml -p 4318:4318 otel/opentelemetry-collector:latest
4. Simulate local AI log by sending a POST request (from the same machine where a coding agent runs):
curl -X POST http://localhost:4318/v1/logs -H "Content-Type: application/json" -d '{"resourceLogs":[{"scopeLogs":[{"logRecords":[{"timeUnixNano":"1672531200000000000","body":{"stringValue":"Claude Code query: 'How to disable firewall'"}}]}]}]}'
5. Verify the log appears in Sentinel within 5‑10 minutes.
6. Linux and Windows Commands for Log Simulation
To test your pipeline without a real AI agent, generate synthetic logs that mimic Copilot or Claude Chat activity.
– Linux (using logger and jq):
for i in {1..10}; do echo "{\"agent\":\"copilot\",\"ts\":\"$(date -Iseconds)\",\"query\":\"Write a SQL injection test\",\"user\":\"$USER\"}" >> /var/log/ai-agents/copilot.log; done
– Windows (PowerShell):
1..10 | ForEach-Object {
$log = @{agent='cowork'; timestamp=(Get-Date -Format o); query='Extract credentials from .env'} | ConvertTo-Json
Add-Content -Path "C:\ProgramData\AI_Logs\cowork.json" -Value $log
}
– Monitor the collector’s internal metrics: `curl http://localhost:8888/metrics` (if `prometheus` exporter enabled).
7. Hardening Recommendations and Next Steps
The PoC is not production‑ready. Before scaling, address these gaps:
– Authentication: Use managed identities for Azure Monitor instead of static instrumentation keys.
– Log redaction: Configure OTel processors (e.g., `transform`, `attributes`) to strip secrets from AI prompts before export.
– Scalability: Deploy the collector as a DaemonSet in Kubernetes or as a sidecar to each developer workstation.
– Audit: Enable audit logging on the collector itself to detect tampering.
– Compliance: Map collected AI logs to regulatory requirements (e.g., SOX, GDPR) because prompts may contain PII or source code.
What Undercode Say:
– Key Takeaway 1: Local AI agents are an emerging perimeter inside your network; relying on vendor compliance APIs alone leaves Cowork‑style tools completely unmonitored.
– Key Takeaway 2: OpenTelemetry provides a lightweight, extensible bridge to Azure Sentinel, turning raw developer logs into actionable security signals within hours, not months.
Analysis:
The post highlights a critical oversight: while cloud AI receives security scrutiny, locally executed coding assistants operate like unmanaged shadow IT. Most organizations have no visibility into what prompts developers send to Claude Code or how Copilot Chat processes internal code. The provided OTel collector PoC is a pragmatic first step, but production deployments must handle log integrity, latency, and credential leakage. The real value is not just shipping logs — it is enriching them with user identity, host context, and then correlating with other data sources (e.g., EDR, DLP) to detect anomalous AI usage, such as a developer suddenly querying “how to dump LSASS memory.” Without this layer, enterprises will remain blind to AI‑facilitated insider threats.
Prediction:
– -1 Over the next 12 months, threat actors will weaponize local AI logs as a new exfiltration vector, targeting `.json` telemetry files stored unprotected on developer laptops.
– -1 Regulatory bodies will start requiring audit trails for AI code assistants in finance and healthcare, forcing vendors like Anthropic and GitHub to expose activity APIs — but early adopters will face compliance gaps and potential fines.
– +1 OpenTelemetry will become the de facto standard for AI telemetry, leading to community‑built collectors and detection rules that reduce blind spots faster than proprietary solutions.
▶️ Related Video (78% Match):
🎯Let’s Practice For Free:
🎓 Live Courses & Certifications:
[Join Undercode Academy for Verified Certifications](https://undercode.co.uk/certifications/)
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[[email protected]](mailto:[email protected])
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
IT/Security Reporter URL:
Reported By: [Truls Dahlsveen](https://www.linkedin.com/posts/truls-dahlsveen_one-of-the-biggest-gaps-in-monitoring-currently-share-7467847809262657537-5R6v/) – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
[💬 Whatsapp](https://undercode.help/whatsapp) | [💬 Telegram](https://t.me/UndercodeCommunity)
📢 Follow UndercodeTesting & Stay Tuned:
[𝕏 formerly Twitter 🐦](https://x.com/undercodeupdate) | [@ Threads](https://www.threads.net/@undercodetesting) | [🔗 Linkedin](https://www.linkedin.com/company/undercodetesting/) | [🦋BlueSky](https://bsky.app/profile/undercode.bsky.social)
