10.2 Anomaly Detection

Description

Agent behavior anomalies MUST be detected and trigger alerts.

Rationale

Anomaly detection catches prompt injection and compromised agents that evade rule-based detection.

Audit Procedure

1. Check for behavioral monitoring
2. Verify baselines are established
3. Review alerting thresholds

Remediation

1. Establish behavioral baselines
2. Implement anomaly detection rules
3. Configure alerts for deviations

Framework Mappings