Why it matters

LLM incidents have unique characteristics. IR playbooks shape response.

Advertisement

The architecture

Detect: monitoring + user reports.

Contain: disable + fallback.

Investigate: audit logs.

Recover: fix + notify.

LLM IR stackDetectmonitor + reportsContaindisable + fallbackInvestigateaudit logsLLM-specific detections: unusual outputs, injection patterns, data leak signals
IR flow.
Advertisement

How it works end to end

Detections: injection patterns, PII in outputs, tool abuse.

Containment: model rollback, feature flag.

Investigation: audit trail.

Recovery: patch + user notify.