Lesson 6 of 6 — Live network-log tap

Automated Discovery Connectors · Source: Jira Story GOV-306 (8 pts) · Authority: Informational (the Jira story is authoritative).

Purpose

Surface shadow AI from live network logs in real time.

Why it matters

Some AI use never appears in any inventory except on the wire.

Where this lives

Runs in the Customer AI Governance platform (components: intelligence). A network-log tap streams and flags shadow-AI traffic in real time. Learn teaches this read-only.

Workflow

1. Given live network logs
2. When the tap runs
3. Then shadow AI is surfaced in a streaming fashion

Worked example

An employee uses an unsanctioned AI API that's in no system list. How might it still be found?

The live network-log tap surfaces the shadow-AI traffic in a streaming fashion.

Acceptance criteria (authoritative — GOV-306)

Given live network logs, when the tap runs, then shadow AI is surfaced in a streaming fashion.

Common pitfalls

• Batch-only scanning that misses transient or streaming usage.

Knowledge check

• Scenario: An employee uses an unsanctioned AI API that's in no system list. How might it still be found?
• Look for: The live network-log tap surfaces the shadow-AI traffic in a streaming fashion.

Key concepts

• network-log tap
• shadow AI
• streaming discovery

For the AI Tutor

• Summary: Surface shadow AI from live network logs in real time.
• When to use: teaching or answering questions about "live network-log tap".
• When NOT to use: the connector interface (that is GOV-301).
• Key concepts: network-log tap, shadow AI, streaming discovery.

Completion criteria

Learner passes the scenario knowledge check and can point to the system state that satisfies GOV-306's acceptance criterion.

Related

• Module: LEARN-MOD-009 (Automated Discovery Connectors)
• Provenance: LEARN-MAP-001 · Generation standard: LEARN-STD-002
• Next: (module complete)