Logging and CERT-In Incident Reporting for AI Features
What to log for agents and how to meet India's six hour reporting rule.
What CERT-In requires
The CERT-In directions of 28 April 2022 require organisations to report specified cyber incidents within six hours of noticing them, and to keep logs of ICT systems for 180 days within Indian jurisdiction. Covered incidents include data breaches, unauthorised access and attacks on applications.
What to log for agents
Log every tool call with the tenant, the input, the output, the model version and any approver. Keep these logs with application, identity and cloud logs so an investigation can follow one event across systems.
- Tool calls and their results.
- Approvals and rejections.
- Blocked actions and policy hits.
- Spend and rate limit events.
Incident criteria
Add AI-specific events to your incident criteria: a confirmed prompt injection that caused an action, data returned across tenants, or a leaked system prompt containing sensitive details. Prepare a reporting template so the six hour clock is achievable.
- Report specified incidents to CERT-In within six hours.
- Keep logs for 180 days in India.
- Log every agent tool call with context.
Check how long your current logs are kept and where. List the agent events you do not log today.
Check your understanding
1. How long must ICT logs be kept under CERT-In directions?
2. What is the CERT-In reporting window?
3. Which event is an AI-specific incident?
From USD 49 or INR 2,999 a month. A person approves every step.