Vaikora - Agent policy violation

Vaikora_AgentSignals_CL
| where TimeGenerated > ago(1h)
| where policy_decision_s == "block"
| summarize
    ViolationCount = count(),
    PolicyIds = make_set(policy_id_s),
    ActionTypes = make_set(action_type_s),
    ResourceTypes = make_set(resource_type_s),
    MaxAnomalyScore = max(anomaly_score_d),
    Severities = make_set(severity_s),
    LogHashes = make_set(log_hash_s)
  by AgentId = agent_id_s
| extend
    PolicyList = strcat_array(PolicyIds, ", "),
    ActionList = strcat_array(ActionTypes, ", "),
    ResourceList = strcat_array(ResourceTypes, ", ")
| where ViolationCount >= 1

version: 1.0.0
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Vaikora-Sentinel/Analytic%20Rules/Vaikora%20-%20Agent%20Policy%20Violation.yaml
triggerThreshold: 0
requiredDataConnectors:
- dataTypes:
  - Vaikora_AgentSignals_CL
  connectorId: VaikoraSentinel
tactics:
- Impact
- DefenseEvasion
customDetails:
  ViolationCount: ViolationCount
  ActionTypes: ActionList
  MaxAnomalyScore: MaxAnomalyScore
  PolicyIds: PolicyList
relevantTechniques:
- T1078
- T1562
kind: Scheduled
suppressionDuration: 15m
entityMappings:
- fieldMappings:
  - identifier: Name
    columnName: AgentId
  entityType: Account
description: |
  Identifies AI agent actions explicitly blocked by a Vaikora policy. Repeated violations from the same agent may indicate prompt injection, policy circumvention, or a compromised workflow.
triggerOperator: GreaterThan
suppressionEnabled: false
status: Available
queryFrequency: 15m
id: 54262ad1-f346-4246-a13f-9557595ff7bd
name: Vaikora - Agent policy violation
severity: Medium
query: |
  Vaikora_AgentSignals_CL
  | where TimeGenerated > ago(1h)
  | where policy_decision_s == "block"
  | summarize
      ViolationCount = count(),
      PolicyIds = make_set(policy_id_s),
      ActionTypes = make_set(action_type_s),
      ResourceTypes = make_set(resource_type_s),
      MaxAnomalyScore = max(anomaly_score_d),
      Severities = make_set(severity_s),
      LogHashes = make_set(log_hash_s)
    by AgentId = agent_id_s
  | extend
      PolicyList = strcat_array(PolicyIds, ", "),
      ActionList = strcat_array(ActionTypes, ", "),
      ResourceList = strcat_array(ResourceTypes, ", ")
  | where ViolationCount >= 1
incidentConfiguration:
  groupingConfiguration:
    lookbackDuration: 1h
    matchingMethod: Selected
    enabled: true
    reopenClosedIncident: false
    groupByEntities:
    - Account
  createIncident: true
queryPeriod: 1h
eventGroupingSettings:
  aggregationKind: AlertPerResult

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/54262ad1-f346-4246-a13f-9557595ff7bd')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/54262ad1-f346-4246-a13f-9557595ff7bd')]",
      "properties": {
        "alertRuleTemplateName": "54262ad1-f346-4246-a13f-9557595ff7bd",
        "customDetails": {
          "ActionTypes": "ActionList",
          "MaxAnomalyScore": "MaxAnomalyScore",
          "PolicyIds": "PolicyList",
          "ViolationCount": "ViolationCount"
        },
        "description": "Identifies AI agent actions explicitly blocked by a Vaikora policy. Repeated violations from the same agent may indicate prompt injection, policy circumvention, or a compromised workflow.\n",
        "displayName": "Vaikora - Agent policy violation",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "AgentId",
                "identifier": "Name"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": true,
            "groupByEntities": [
              "Account"
            ],
            "lookbackDuration": "PT1H",
            "matchingMethod": "Selected",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Vaikora-Sentinel/Analytic%20Rules/Vaikora%20-%20Agent%20Policy%20Violation.yaml",
        "query": "Vaikora_AgentSignals_CL\n| where TimeGenerated > ago(1h)\n| where policy_decision_s == \"block\"\n| summarize\n    ViolationCount = count(),\n    PolicyIds = make_set(policy_id_s),\n    ActionTypes = make_set(action_type_s),\n    ResourceTypes = make_set(resource_type_s),\n    MaxAnomalyScore = max(anomaly_score_d),\n    Severities = make_set(severity_s),\n    LogHashes = make_set(log_hash_s)\n  by AgentId = agent_id_s\n| extend\n    PolicyList = strcat_array(PolicyIds, \", \"),\n    ActionList = strcat_array(ActionTypes, \", \"),\n    ResourceList = strcat_array(ResourceTypes, \", \")\n| where ViolationCount >= 1\n",
        "queryFrequency": "PT15M",
        "queryPeriod": "PT1H",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT15M",
        "suppressionEnabled": false,
        "tactics": [
          "DefenseEvasion",
          "Impact"
        ],
        "techniques": [
          "T1078",
          "T1562"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}