Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

AIShield - Timeseries Forecasting AI Model extraction high suspicious vulnerability detection

Back
Id37118ef6-73b4-49aa-b13b-cdeeeea580df
RulenameAIShield - Timeseries Forecasting AI Model extraction high suspicious vulnerability detection
DescriptionThis alert creates an incident when Timeseries Forecasting AI Model extraction high suspicious, high severity vulnerability detected from the AIShield.
SeverityHigh
Required data connectorsBoschAIShield
KindScheduled
Query frequency1h
Query period1h
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/AIShield AI Security Monitoring/Analytic Rules/TimeSeriesForecastingModelExtractionHighSuspiciousVulnDetection.yaml
Version1.0.4
Arm template37118ef6-73b4-49aa-b13b-cdeeeea580df.json
Deploy To Azure
AIShield
| where Message has 'Timeseries Forecasting AI Model Extraction Attack Identified'
| where Severity =~ 'High'
| where SuspiciousLevel =~ 'high suspicious attack'
| extend NTDomain = tostring(split(Computer, '\\')[0]), HostName = tostring(split(Computer, '.')[0])
version: 1.0.4
severity: High
triggerOperator: gt
id: 37118ef6-73b4-49aa-b13b-cdeeeea580df
description: |
    'This alert creates an incident when Timeseries Forecasting AI Model extraction high suspicious, high severity vulnerability detected from the AIShield.'
eventGroupingSettings:
  aggregationKind: SingleAlert
tactics: []
triggerThreshold: 0
query: |
  AIShield
  | where Message has 'Timeseries Forecasting AI Model Extraction Attack Identified'
  | where Severity =~ 'High'
  | where SuspiciousLevel =~ 'high suspicious attack'
  | extend NTDomain = tostring(split(Computer, '\\')[0]), HostName = tostring(split(Computer, '.')[0])  
name: AIShield - Timeseries Forecasting AI Model extraction high suspicious vulnerability detection
relevantTechniques: []
requiredDataConnectors:
- dataTypes:
  - AIShield
  connectorId: BoschAIShield
status: Available
queryPeriod: 1h
entityMappings:
- fieldMappings:
  - columnName: HostName
    identifier: HostName
  - columnName: NTDomain
    identifier: NTDomain
  entityType: Host
- fieldMappings:
  - columnName: SourceName
    identifier: Address
  entityType: IP
kind: Scheduled
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/AIShield AI Security Monitoring/Analytic Rules/TimeSeriesForecastingModelExtractionHighSuspiciousVulnDetection.yaml
alertDetailsOverride:
  alertDescriptionFormat: |
        This query detects Timeseries Forecasting AI Model extraction high suspicious, high severity alert from AIShield generated at {{TimeGenerated}}.\n\nPlease check the source for more information and investigate further.
  alertTacticsColumnName: 
  alertSeverityColumnName: Severity
  alertDisplayNameFormat: AIShield -Timeseries Forecasting AI Model extraction high suspicious vulnerability detected.
queryFrequency: 1h
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/37118ef6-73b4-49aa-b13b-cdeeeea580df')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/37118ef6-73b4-49aa-b13b-cdeeeea580df')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "This query detects Timeseries Forecasting AI Model extraction high suspicious, high severity alert from AIShield generated at {{TimeGenerated}}.\\n\\nPlease check the source for more information and investigate further.\n",
          "alertDisplayNameFormat": "AIShield -Timeseries Forecasting AI Model extraction high suspicious vulnerability detected.",
          "alertSeverityColumnName": "Severity",
          "alertTacticsColumnName": null
        },
        "alertRuleTemplateName": "37118ef6-73b4-49aa-b13b-cdeeeea580df",
        "customDetails": null,
        "description": "'This alert creates an incident when Timeseries Forecasting AI Model extraction high suspicious, high severity vulnerability detected from the AIShield.'\n",
        "displayName": "AIShield - Timeseries Forecasting AI Model extraction high suspicious vulnerability detection",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Host",
            "fieldMappings": [
              {
                "columnName": "HostName",
                "identifier": "HostName"
              },
              {
                "columnName": "NTDomain",
                "identifier": "NTDomain"
              }
            ]
          },
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "SourceName",
                "identifier": "Address"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "SingleAlert"
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/AIShield AI Security Monitoring/Analytic Rules/TimeSeriesForecastingModelExtractionHighSuspiciousVulnDetection.yaml",
        "query": "AIShield\n| where Message has 'Timeseries Forecasting AI Model Extraction Attack Identified'\n| where Severity =~ 'High'\n| where SuspiciousLevel =~ 'high suspicious attack'\n| extend NTDomain = tostring(split(Computer, '\\\\')[0]), HostName = tostring(split(Computer, '.')[0])\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "severity": "High",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [],
        "techniques": [],
        "templateVersion": "1.0.4",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}