From Agent Telemetry to Detection Engineering

Autonomous AI agents increasingly operate as active enterprise workloads, invoking tools, identities, processes, network services, cloud APIs, and Model Context Protocol (MCP) resources while pursuing delegated objectives. Recent research has established foundations for behavioral trajectory analysis, agent observability, MCP security monitoring, and cross-layer reconstruction. This practitioner research note examines the operational Detection Engineering problem that follows: how should agent-security signals be represented, correlated, converted into detections, and investigated using telemetry available to an enterprise SOC? The note proposes an agent-centric detection model spanning agent/MCP, identity, endpoint, network, cloud, and SaaS telemetry. It treats the Agent Behavioral Trajectory as a working operational abstraction for reconstructing externally observable actions and environmental effects associated with a delegated task, without requiring access to private chain-of-thought. This work does not claim novelty for behavioral trajectory analysis, MCP monitoring, or cross-layer observability. Instead, it defines an operational research agenda for translating these concepts into security schemas, correlation primitives, detection-as-code, investigation workflows, and experimental evaluation in SIEM environments.