Vaikora - High severity AI agent action detected | Microsoft Sentinel Analytic Rules

Back


Id	15c49777-7cb7-4746-8064-6fa4c7a73df8
Rulename	Vaikora - High severity AI agent action detected
Description	Identifies AI agent actions from Vaikora classified as high or critical severity. These events may indicate an agent operating outside safe parameters or triggering policy thresholds.
Severity	High
Tactics	Impact Execution PrivilegeEscalation
Techniques	T1059 T1078 T1548
Required data connectors	VaikoraSentinel
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	GreaterThan
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Vaikora-Sentinel/Analytic%20Rules/Vaikora%20-%20High%20Risk%20AI%20Agent%20Action.yaml
Version	1.0.0
Arm template	15c49777-7cb7-4746-8064-6fa4c7a73df8.json

KQL

Vaikora_AgentSignals_CL
| where TimeGenerated > ago(1h)
| where severity_s in ("high", "critical")
| summarize
    ActionCount = count(),
    MaxAnomalyScore = max(anomaly_score_d),
    Actions = make_set(action_type_s),
    PolicyDecisions = make_set(policy_decision_s),
    ResourceTypes = make_set(resource_type_s),
    LogHashes = make_set(log_hash_s)
  by AgentId = agent_id_s, Severity = severity_s
| extend
    ActionList = strcat_array(Actions, ", "),
    PolicyList = strcat_array(PolicyDecisions, ", "),
    ResourceList = strcat_array(ResourceTypes, ", ")

YAML

incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    groupByEntities:
    - Account
    enabled: true
    matchingMethod: Selected
    reopenClosedIncident: false
    lookbackDuration: 1h
entityMappings:
- entityType: Account
  fieldMappings:
  - columnName: AgentId
    identifier: Name
query: |
  Vaikora_AgentSignals_CL
  | where TimeGenerated > ago(1h)
  | where severity_s in ("high", "critical")
  | summarize
      ActionCount = count(),
      MaxAnomalyScore = max(anomaly_score_d),
      Actions = make_set(action_type_s),
      PolicyDecisions = make_set(policy_decision_s),
      ResourceTypes = make_set(resource_type_s),
      LogHashes = make_set(log_hash_s)
    by AgentId = agent_id_s, Severity = severity_s
  | extend
      ActionList = strcat_array(Actions, ", "),
      PolicyList = strcat_array(PolicyDecisions, ", "),
      ResourceList = strcat_array(ResourceTypes, ", ")
suppressionEnabled: false
eventGroupingSettings:
  aggregationKind: AlertPerResult
id: 15c49777-7cb7-4746-8064-6fa4c7a73df8
queryFrequency: 1h
status: Available
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Vaikora-Sentinel/Analytic%20Rules/Vaikora%20-%20High%20Risk%20AI%20Agent%20Action.yaml
suppressionDuration: 1h
version: 1.0.0
severity: High
relevantTechniques:
- T1059
- T1078
- T1548
name: Vaikora - High severity AI agent action detected
kind: Scheduled
tactics:
- Impact
- Execution
- PrivilegeEscalation
requiredDataConnectors:
- dataTypes:
  - Vaikora_AgentSignals_CL
  connectorId: VaikoraSentinel
description: |
  Identifies AI agent actions from Vaikora classified as high or critical severity. These events may indicate an agent operating outside safe parameters or triggering policy thresholds.
customDetails:
  ActionCount: ActionCount
  ResourceTypes: ResourceList
  MaxAnomalyScore: MaxAnomalyScore
  PolicyDecisions: PolicyList
  Actions: ActionList
triggerOperator: GreaterThan
triggerThreshold: 0
queryPeriod: 1h

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/15c49777-7cb7-4746-8064-6fa4c7a73df8')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/15c49777-7cb7-4746-8064-6fa4c7a73df8')]",
      "properties": {
        "alertRuleTemplateName": "15c49777-7cb7-4746-8064-6fa4c7a73df8",
        "customDetails": {
          "ActionCount": "ActionCount",
          "Actions": "ActionList",
          "MaxAnomalyScore": "MaxAnomalyScore",
          "PolicyDecisions": "PolicyList",
          "ResourceTypes": "ResourceList"
        },
        "description": "Identifies AI agent actions from Vaikora classified as high or critical severity. These events may indicate an agent operating outside safe parameters or triggering policy thresholds.\n",
        "displayName": "Vaikora - High severity AI agent action detected",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "AgentId",
                "identifier": "Name"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": true,
            "groupByEntities": [
              "Account"
            ],
            "lookbackDuration": "PT1H",
            "matchingMethod": "Selected",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Vaikora-Sentinel/Analytic%20Rules/Vaikora%20-%20High%20Risk%20AI%20Agent%20Action.yaml",
        "query": "Vaikora_AgentSignals_CL\n| where TimeGenerated > ago(1h)\n| where severity_s in (\"high\", \"critical\")\n| summarize\n    ActionCount = count(),\n    MaxAnomalyScore = max(anomaly_score_d),\n    Actions = make_set(action_type_s),\n    PolicyDecisions = make_set(policy_decision_s),\n    ResourceTypes = make_set(resource_type_s),\n    LogHashes = make_set(log_hash_s)\n  by AgentId = agent_id_s, Severity = severity_s\n| extend\n    ActionList = strcat_array(Actions, \", \"),\n    PolicyList = strcat_array(PolicyDecisions, \", \"),\n    ResourceList = strcat_array(ResourceTypes, \", \")\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "severity": "High",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Execution",
          "Impact",
          "PrivilegeEscalation"
        ],
        "techniques": [
          "T1059",
          "T1078",
          "T1548"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}