Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

AIShield - Image Segmentation AI Model extraction high suspicious vulnerability detection

Back
Id1ed02dcc-0bc9-465e-94b4-bd8969221602
RulenameAIShield - Image Segmentation AI Model extraction high suspicious vulnerability detection
DescriptionThis alert creates an incident when Image Segmentation AI Model extraction high suspicious, high severity vulnerability detected from the AIShield.
SeverityHigh
Required data connectorsBoschAIShield
KindScheduled
Query frequency1h
Query period1h
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/AIShield AI Security Monitoring/Analytic Rules/ImageSegmentationModelExtractionHighSuspiciousVulnDetection.yaml
Version1.0.4
Arm template1ed02dcc-0bc9-465e-94b4-bd8969221602.json
Deploy To Azure
AIShield
| where Message has 'Image Segmentation AI Model Extraction Attack Identified'
| where Severity =~ 'High'
| where SuspiciousLevel =~ 'high suspicious attack'
| extend NTDomain = tostring(split(Computer, '\\')[0]), HostName = tostring(split(Computer, '.')[0])
name: AIShield - Image Segmentation AI Model extraction high suspicious vulnerability detection
severity: High
triggerOperator: gt
relevantTechniques: []
version: 1.0.4
entityMappings:
- fieldMappings:
  - columnName: HostName
    identifier: HostName
  - columnName: NTDomain
    identifier: NTDomain
  entityType: Host
- fieldMappings:
  - columnName: SourceName
    identifier: Address
  entityType: IP
queryPeriod: 1h
requiredDataConnectors:
- dataTypes:
  - AIShield
  connectorId: BoschAIShield
triggerThreshold: 0
tactics: []
alertDetailsOverride:
  alertTacticsColumnName: 
  alertDescriptionFormat: |
        This query detects Image Segmentation AI Model extraction high suspicious, high severity alert from AIShield generated at {{TimeGenerated}}.\n\nPlease check the source for more information and investigate further.
  alertDisplayNameFormat: AIShield - Image Segmentation AI Model extraction high suspicious vulnerability detected.
  alertSeverityColumnName: Severity
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/AIShield AI Security Monitoring/Analytic Rules/ImageSegmentationModelExtractionHighSuspiciousVulnDetection.yaml
status: Available
query: |
  AIShield
  | where Message has 'Image Segmentation AI Model Extraction Attack Identified'
  | where Severity =~ 'High'
  | where SuspiciousLevel =~ 'high suspicious attack'
  | extend NTDomain = tostring(split(Computer, '\\')[0]), HostName = tostring(split(Computer, '.')[0])  
queryFrequency: 1h
id: 1ed02dcc-0bc9-465e-94b4-bd8969221602
kind: Scheduled
eventGroupingSettings:
  aggregationKind: SingleAlert
description: |
    'This alert creates an incident when Image Segmentation AI Model extraction high suspicious, high severity vulnerability detected from the AIShield.'
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/1ed02dcc-0bc9-465e-94b4-bd8969221602')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/1ed02dcc-0bc9-465e-94b4-bd8969221602')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "This query detects Image Segmentation AI Model extraction high suspicious, high severity alert from AIShield generated at {{TimeGenerated}}.\\n\\nPlease check the source for more information and investigate further.\n",
          "alertDisplayNameFormat": "AIShield - Image Segmentation AI Model extraction high suspicious vulnerability detected.",
          "alertSeverityColumnName": "Severity",
          "alertTacticsColumnName": null
        },
        "alertRuleTemplateName": "1ed02dcc-0bc9-465e-94b4-bd8969221602",
        "customDetails": null,
        "description": "'This alert creates an incident when Image Segmentation AI Model extraction high suspicious, high severity vulnerability detected from the AIShield.'\n",
        "displayName": "AIShield - Image Segmentation AI Model extraction high suspicious vulnerability detection",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Host",
            "fieldMappings": [
              {
                "columnName": "HostName",
                "identifier": "HostName"
              },
              {
                "columnName": "NTDomain",
                "identifier": "NTDomain"
              }
            ]
          },
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "SourceName",
                "identifier": "Address"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "SingleAlert"
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/AIShield AI Security Monitoring/Analytic Rules/ImageSegmentationModelExtractionHighSuspiciousVulnDetection.yaml",
        "query": "AIShield\n| where Message has 'Image Segmentation AI Model Extraction Attack Identified'\n| where Severity =~ 'High'\n| where SuspiciousLevel =~ 'high suspicious attack'\n| extend NTDomain = tostring(split(Computer, '\\\\')[0]), HostName = tostring(split(Computer, '.')[0])\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "severity": "High",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [],
        "techniques": [],
        "templateVersion": "1.0.4",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}