docs: notes from 2025-12-16 audit logging wg

Signed-off-by: Alan Pinkert <apinkert@cisco.com>

Author: alanisaac

docs/contribute/wip/5_Audit_Logs_Standardization/meeting_notes/2025-12-16.md

@@ -0,0 +1,52 @@
+# Notes
+
+* We have connections with the Otel working group (TODO)
+* OASF
+    * More about classifying Agent skills than agentic events
+    * Maybe not an immediate connection
+* OCSF
+    * Captures events for security practitioners
+    * Might need more agentic
+* What are looking for in this working group?
+    * Customers frustrated with too many standards they need to adopt
+        * Example: accounting firm, RAG on tax docs.  Only these specific people should respond to it.  But don’t know the best practices, and would find guidance helpful.
+        * Lots of startups around deploy-stack for management of MCP servers, LLMs, etc., but what are the blind spots?
+        * Example: customer wrapping APIs with an internal MCP server.  Reason: before, they needed to train their support team on how to read audit logs, now, they have them ask the chatbot.
+    * Guidance vs a specification?
+        * Proposal: we should build out an SDK
+        * Contribute it back to Otel?
+        * Challenge: making something overly broad vs narrow and specific to start with
+        * Easier exercise: what vs how?
+        * But — we might close the door on certain paths on what we want to audit
+* Observe Discussion
+    * SDK: pure SDK for traces and spans for Otel
+    * Poirot: creates metrics around traces
+    * Integrations with LangChain, e.g. as well as MCP servers
+* Personas
+    * Higher priority - Identity
+        * Compliance Professionals
+        * Security Professionals
+        * Support Teams (audit-logs-as-training-data)
+    * Lower priority (not a part of the identity working group)
+        * Agent and Agentic Resource Developers
+    * How are personas going to be consuming this?
+        * Example: how can they use LLMs to cut down event noise
+        * Will it be these human personas consuming audit logs or their agents?
+* Standards
+    * SET (security event tokens)
+    * CADF (cloud auditing data federation)
+    * CEF (common event format)
+    * SSF (shared signals framework) — RISC / CAEP
+    * Microsoft extension to SCIM
+    * Be wary of https://xkcd.com/927/
+
+# Action Items
+
+1. Nailing down persona / use cases
+2. What are the data points that we need recorded
+3. Look at existing standards & frameworks, compare to 2. above
+4. Converge: pursue these tracks
+ 
+# Logistics
+
+Next meeting will be 2025-01-13 because of the holidays.  See everyone in the new year!