OneTrust AI Log Analyzer

As organizations scale AI use cases, governance teams need a "single pane of glass" to monitor risk, performance, and compliance across AI assets. The AI Log Analyzer (AILA) helps you audit AI logs to understand how your AI agents and models handle personally identifiable information (PII). It supports Amazon Bedrock logs stored in Amazon S3 and Databricks inference tables.

The AI Log Analyzer randomly samples available AI-generated logs and uses OneTrust's classification and scanner capabilities to:

• Detect PII in AI prompt and response logs
• Generate key metrics for each AI asset:
  • Prompt PII count
  • Response PII count
  • Prompt PII categories (for example, email or phone number)
  • Response PII categories
• Associate findings with the specific AI models or agents in your AI governance framework

To use AI Log Analyzer with Amazon Bedrock, enable invocation logging to Amazon S3 and ensure Amazon Bedrock can write logs to the target bucket. Example S3 bucket policy:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowBedrockWrite",
            "Effect": "Allow",
            "Principal": {
                "Service": "bedrock.amazonaws.com"
            },
            "Action": "s3:PutObject",
            "Resource": "arn:aws:s3:::bedrock-logs-bucket/*"
        }
    ]
}

The role or user that configures Amazon Bedrock logging must also be allowed to enable and view the logging configuration. Example IAM policy:

{
    "Effect": "Allow",
    "Action": [
        "bedrock:InvokeModel",
        "bedrock:PutModelInvocationLoggingConfiguration",
        "bedrock:GetModelInvocationLoggingConfiguration"
    ],
    "Resource": "*"
}

If the S3 bucket is accessed through browser-based tools or frontend applications, configure CORS on the bucket. Example:

[
    {
        "AllowedHeaders": [
            "*"
        ],
        "AllowedMethods": [
            "GET",
            "PUT",
            "POST"
        ],
        "AllowedOrigins": [
            "*"
        ],
        "ExposeHeaders": [
            "Access-Control-Allow-Origin"
        ]
    }
]

To use AI Log Analyzer, OneTrust AI Governance administrators deploy a lightweight worker node through AI Automations. For Databricks, a Databricks administrator must also configure inference tables for the endpoints you want to scan. No other configuration is needed in OneTrust.

Once AI Log Analyzer is running, PII and data classification metrics appear in the inventory record for each scanned model or agent under Details > Sensitive data classification. The following metrics are shown:

• Prompt PII count - the total number of PII instances detected in prompts.

• Prompt PII categories - the types of PII detected in prompts, such as phone numbers or email addresses

• Response PII count - the total number of PII instances detected in responses.

• Response PII categories - the types of PII detected in responses.

Each metric shows the date of its last run. This lets you:

• Review the most recent classification data. The data shown reflects the last day of activity since the last sync.

• Compare classification results with the AI asset's declared use case and data in the inventory.

The details page shows results from the last day. Historical data is retained to support future enhancements such as trend analysis.

To monitor and enforce thresholds for reported metrics, we recommend setting up custom policies. You can track individual metrics or groups of metrics, such as prompt and response PII counts, against thresholds your organization defines. A breach of a threshold results in a policy violation, which helps surface deviations across a large inventory of models and agents.

For more information on creating custom policies, see the AI Policies Feature Guide.