Outcome
By the end of this lesson, you will be able to read MCP audit logs to track usage, construct common audit queries (compliance, forensics, abuse detection), and wire anomaly alerts to your SIEM.
| Prerequisites | M6.3.L1 (PAT) · M6.3.L2 (org toggle) |
| Time | 9 minutes |
1. Concept
Every call an assistant makes is written to the same audit log as everything a person does in the product.
There is no separate AI log to go and find. One place answers who looked at what, when, through which MCP tool call, and whether it worked.
AUDIT LOG ENTRY for an MCP call: Timestamp: 2026-05-21T14:32:00Z User: jane@platform Source: mcp Tool: list_resources Request: {region: us-east-1, sort: idle_days} Status: 200The audit log is the foundation of compliance + forensics + abuse detection for MCP usage.
Why this matters
COMPLIANCE: "Show me everything jane@platform did via MCP in May 2026." → Single audit query, returns full history with timestamps, tools called and the arguments they were called with.
INCIDENT FORENSICS: "Did anyone read prod-payments cost data last week?" → Audit log shows who, when, via which tool, with what filters.
ABUSE DETECTION: Spikes in tool call rate → possible misuse or stolen PAT Tool used outside business hours → possible compromise Exported audit logs feed detection rules in your SIEM.
CAPACITY PLANNING: Which MCP tools are most-used? Which engineers rely on MCP most? Useful for both ZopNight + customer engineering leadership.Reading audit logs
ZOPNIGHT UI: Activity → Audit Logs (/audit-logs) Source filter: MCP; also filter by user, action, resource, status and date range Export the filtered view to CSV (built in the background, emailed to you as a download link)
API: GET /audit-logs?source=mcp&user=jane@platform The gateway scopes it to your org; returns paginated JSON POST /audit-logs/export starts the CSV export (emailed)
DOWNSTREAM (recommended for compliance): Load the CSV exports into your SIEM on a schedule Splunk / Datadog / Sumo Logic / ElasticWhat’s logged (in detail)
INCLUDED in every MCP audit entry: User identity (email) Tool called (e.g., list_resources) Request body (the tool's arguments) Status code, plus the error message on failure Source (mcp)
NOT RECORDED YET: Which of the user's tokens made the call Which AI tool (client) made the call
NOT INCLUDED: The response body of a read call (sensitive cost data), dropped on success and on failure The LLM's prompt or conversation context Engineer's intent ("I asked the agent to find waste")Write calls are different: their response body is kept, unless the tool’s arguments carry secrets, in which case it is dropped.
You see the tool calls the agent made; you don’t see what the engineer asked the LLM. This balance preserves privacy + audit utility.
No full-response switch
There is no setting to keep the full response of a read call. ZopNight drops the response body of every MCP read, on success and on failure, and keeps a write’s response unless the tool’s arguments carry secrets.
If an investigation needs the actual responses, capture them on the client side, in the tool that made the call.
Audit log retention and export
RETENTION: audit rows are kept indefinitely; there is no retention setting and no purge jobEXPORT: Activity → Audit Logs → export the filtered view CSV is built in the background and emailed to you as a download link (the link expires after 1 hour)STREAMING: none; there is no live feed to a SIEMFor SOC 2 or regulatory retention, export on a fixed schedule (for example monthly) and load each CSV into your SIEM or archive, so the copy you rely on lives under your own retention policy.
Common audit queries
QUERY 1: "Top 10 most-called tools last week" Filter: source=mcp, time>=7d Group: tool Sort: count desc, limit 10 Use: Understand which workflows are popular; informs which prompts are worth saving as team skills (M6.4).
QUERY 2: "Failed MCP calls in last 24 hours" Filter: source=mcp, status=error, time>=24h Use: Detect issues (PAT expired? Tool deprecated?), problems, potential attacks.
QUERY 3: "User X's MCP activity in May 2026" Filter: source=mcp, user=jane@platform, time>=2026-05-01 Use: Compliance review; "show me what user X did" requests.
QUERY 4: "Unusual unfiltered tool calls" Filter: tool=list_resources, no filter params (or wildcard) Use: Detect data dumps / exfiltration attempts.
QUERY 5: "Audit log access via MCP" Filter: tool=list_audit_logs Use: Meta-audit; who's looking at the audit logs themselves.
QUERY 6: "MCP calls from someone who has not used MCP before" Filter: source=mcp, user NOT IN (your known MCP users) Use: Spot a token being used by someone, or something, nobody set up. The log does not yet record which AI tool or which token made a call, so the user is the signal to watch.Alerting on anomalies
Wire these signals to your SIEM:
RECOMMENDED ALERTS: First MCP calls from a user who has not used MCP before 100+ MCP calls in 1 minute (rate spike) Tool calls outside business hours (e.g., 3 AM local) User uses tool they've never used (new behavior pattern) PAT used after the user was deprovisioned (this should never happen) Large unfiltered queries (potential exfiltration) Audit log access via MCP (meta-recon)These map to common attack patterns. Investing in alerting once pays off for years.
What an attacker with a stolen PAT does
ATTACKER PROFILE (hypothetical, but well-documented in the wild):
Initial recon: list_cloud_accounts (what clouds are connected) list_resources (what's there) list_audit_logs (what's been done; security posture)
Mid-attack: Large get_costs queries (info gathering for blackmail / ransom) Search for high-value data patterns
Detection signals (all visible in audit log if you're watching): Unusual hour (3 AM local) Large unfiltered queries First-time tool usage by this user First MCP use by this user Rate spike
If your SIEM has these rules wired, the attack is detectable inminutes, not days.Compliance reports
Quarterly MCP usage report for compliance review:
ZopNight Q2 2026 MCP Audit Summary─────────────────────────────────────────────────────────────────Total MCP calls: 12,400Unique users: 23Tool diversity: 61 distinct tools usedFailed calls: 47 (0.4%)Outliers detected: 2 (both benign: investigated and documented)PATs rotated: 18 (per quarterly policy; from your runbook)Toggle state: Enabled (no outages)
REVIEWED BY: CISO, FinOps Lead, Compliance OfficerSIGNED: 2026-07-15Build it from the CSV export, and shape it to your specific compliance frameworks.
2. Demo
A weekly MCP review by the FinOps team:
WEEKLY MCP REVIEW (every Monday, 10 minutes):
T+0 OPEN ZopNight → Activity → Audit Logs, Source: MCP, last 7 days
T+1 min INSIGHTS visible: 1,200 MCP calls across 18 users (healthy adoption) Top tool: get_recommendation_summary (200 calls, 17% of total) 1 user's first MCP calls (verified: engineer trying a new AI tool) 3 failed calls (all PAT-expired; user re-rotated successfully) No suspicious patterns
T+3 min DRILL into anomalies: First-time MCP user: User: alice@platform Calls: read-only tools, normal pattern Asked alice: she set up a new AI tool this week (the log does not record which tool, so ask) Decision: legitimate; document, no action
T+5 min ACTION ITEMS: Ask engineers to flag a new MCP setup before first use (avoids future flagging on the daily alerting) Add the first-time-user pattern to the PAT-rotation runbook
T+8 min DOCUMENT the review (audit log of the audit log): Brief Slack post to #finops-leadership: "Weekly MCP review: 1.2K calls, 18 users, no incidents. Minor flagging on alice@platform, first MCP use (legitimate). Next review: 2026-05-28."
ELAPSED: 8 minutes; signature on quarterly compliance report.The weekly review keeps anomalies visible; the quarterly report consolidates for compliance.
3. Hands-on (5 min)
Open your ZopNight audit log:
□ Filter to source=mcp, last 7 days□ Note: total call count, unique users, top tools
INSIGHTS: Total calls last 7 days: _____ Unique users: _____ Top 3 tools by call count: 1. __________ count: _____ 2. __________ count: _____ 3. __________ count: _____
ANY ANOMALIES? New MCP users? Yes / No Off-hours usage? Yes / No Failed call cluster? Yes / No Tool diversity spike? Yes / No
WIRED TO SIEM? □ Yes: what alert rules? □ No: plan to wire? __________
WEEKLY REVIEW scheduled? □ Yes: frequency: __________ □ No: plan to startIf you don’t have a weekly MCP review yet, this is a 10-minute habit worth establishing.
Ask for it instead. The same task you just did in the console, asked in one sentence.
BEFORE A ZopNight account with one cloud connected. A week of activity through the assistant, so there is something to audit.ASK "Show me what was done through the assistant this week, and who did it."CHECK that every action carries a person. An action without one is the finding, not the noise.Tools behind it: list_audit_logs (read, Govern), list_users (read, Govern), get_my_permissions (read, Introspect). Connection details are in the MCP integration docs.
4. Knowledge check
Q1
MCP audit log captures:
A. The engineer’s full chat transcript with the LLM, including all prompts
B. Tool calls + arguments + status + user identity
C. Only the tool name and the timestamp of each individual call that is made
D. Nothing useful at all, since MCP traffic bypasses the audit path entirely
Show answer
Correct: B. Not the LLM conversation or the engineer’s prompt. You see what the agent did, and the way the engineer phrased the request stays private.
Q2
Anomaly detection on MCP usage:
A. Not possible, because the audit log records only the tool name and never the wider pattern of usage
B. It auto-blocks the suspicious activity, revoking the PAT before any human has looked at the pattern
C. Only for Admin accounts, since ordinary users cannot generate enough volume to be worth watching closely
D. Yes; unusual times, first-time MCP users, never-used tools, rate spikes, large unfiltered queries, post-deprovisioning usage
Show answer
Correct: D. Each signal maps to a known attack pattern. Load the exported logs into your SIEM, wire these rules, and investigate matches.
Q3
For long-term retention of MCP audit records, the supported path is:
A. Scheduled CSV exports, loaded into your own SIEM or archive
B. A retention setting under Settings that extends the audit window
C. A live stream that pushes every audit row straight to your SIEM
D. Turning on full response logging so each entry is kept longer
Show answer
Correct: A. ZopNight keeps audit rows with no retention setting, no SIEM stream and no full-response switch. The CSV export is emailed to you; loading it into your own store on a schedule puts retention under your control.
5. Apply
Weekly MCP audit review (10 minutes). CSV exports into your SIEM for long-term retention. Alert on the documented anomalies. Quarterly compliance report.
For incidents: the audit log is the forensics tool. Filter to source=mcp; reconstruct what the actor did.