Amazon Bedrock Model Invocation Log Monitoring

Integration Overview

Amazon Bedrock is AWS's managed service for building and running generative AI applications using foundation models. Model invocation logging captures input and output data for every model call made in your AWS account, giving security teams visibility into how AI models are being used across the organization. Panther ingests Bedrock model invocation logs via CloudWatch or S3, normalizing and storing them in a Snowflake-powered security data lake for detection and investigation alongside the rest of your AWS telemetry.

Use Cases for Amazon Bedrock Model Invocation Logs

Common SIEM use cases for these logs include:

• Detecting anomalous or unauthorized model invocation activity across your AWS account

• Monitoring AI model usage patterns for data governance and compliance requirements

• Correlating Bedrock activity with other AWS logs to investigate potential misuse of AI infrastructure

Onboarding Amazon Bedrock Model Invocation Logs in Panther

Panther's integration for Amazon Bedrock is easy to configure, allowing you to onboard your log data in just a few minutes. Model invocation logs can be delivered to Panther via either AWS CloudWatch or an S3 bucket, depending on your existing AWS logging configuration.

For more detailed steps on onboarding Amazon Bedrock model invocation logs or for supported log schema, you can view our Amazon Bedrock documentation here.