Vaikora - High severity AI agent action

Vaikora_AgentSignals_CL
| where TimeGenerated >= ago(6h)
| where severity_s in ("high", "critical")
| extend
    ActionId     = action_id_s,
    AgentId      = agent_id_s,
    ActionType   = action_type_s,
    Severity     = severity_s,
    Status       = status_s,
    IsAnomaly    = is_anomaly_b,
    AnomalyScore = anomaly_score_d
| project TimeGenerated, ActionId, AgentId, ActionType, Severity, Status, IsAnomaly, AnomalyScore
| order by TimeGenerated desc

requiredDataConnectors:
- dataTypes:
  - Vaikora_AgentSignals_CL
  connectorId: VaikoraSecurityCenter
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Vaikora-AzureSecurityCenter/Analytic%20Rules/Vaikora%20-%20High%20Severity%20Security%20Alerts.yaml
version: 1.0.1
status: Available
alertDetailsOverride:
  alertDescriptionFormat: Vaikora detected a {{severity_s}} severity action on agent {{agent_id_s}}.
  alertDisplayNameFormat: 'Vaikora {{severity_s}} agent action: {{action_type_s}}'
  alertSeverityColumnName: severity_s
queryFrequency: 6h
query: |
  Vaikora_AgentSignals_CL
  | where TimeGenerated >= ago(6h)
  | where severity_s in ("high", "critical")
  | extend
      ActionId     = action_id_s,
      AgentId      = agent_id_s,
      ActionType   = action_type_s,
      Severity     = severity_s,
      Status       = status_s,
      IsAnomaly    = is_anomaly_b,
      AnomalyScore = anomaly_score_d
  | project TimeGenerated, ActionId, AgentId, ActionType, Severity, Status, IsAnomaly, AnomalyScore
  | order by TimeGenerated desc
tactics:
- InitialAccess
- Execution
- Persistence
- DefenseEvasion
- CredentialAccess
- Discovery
- LateralMovement
- Collection
- CommandAndControl
- Exfiltration
- Impact
relevantTechniques: []
id: ac3ec787-fd49-4e93-88cc-aaa9b31061ac
triggerThreshold: 0
triggerOperator: gt
name: Vaikora - High severity AI agent action
queryPeriod: 6h
severity: High
entityMappings:
- fieldMappings:
  - columnName: AgentId
    identifier: Name
  entityType: Account
kind: Scheduled
description: |
  Identifies high or critical severity AI agent actions ingested from Vaikora in the last 6 hours.

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/ac3ec787-fd49-4e93-88cc-aaa9b31061ac')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/ac3ec787-fd49-4e93-88cc-aaa9b31061ac')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "Vaikora detected a {{severity_s}} severity action on agent {{agent_id_s}}.",
          "alertDisplayNameFormat": "Vaikora {{severity_s}} agent action: {{action_type_s}}",
          "alertSeverityColumnName": "severity_s"
        },
        "alertRuleTemplateName": "ac3ec787-fd49-4e93-88cc-aaa9b31061ac",
        "customDetails": null,
        "description": "Identifies high or critical severity AI agent actions ingested from Vaikora in the last 6 hours.\n",
        "displayName": "Vaikora - High severity AI agent action",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "AgentId",
                "identifier": "Name"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Vaikora-AzureSecurityCenter/Analytic%20Rules/Vaikora%20-%20High%20Severity%20Security%20Alerts.yaml",
        "query": "Vaikora_AgentSignals_CL\n| where TimeGenerated >= ago(6h)\n| where severity_s in (\"high\", \"critical\")\n| extend\n    ActionId     = action_id_s,\n    AgentId      = agent_id_s,\n    ActionType   = action_type_s,\n    Severity     = severity_s,\n    Status       = status_s,\n    IsAnomaly    = is_anomaly_b,\n    AnomalyScore = anomaly_score_d\n| project TimeGenerated, ActionId, AgentId, ActionType, Severity, Status, IsAnomaly, AnomalyScore\n| order by TimeGenerated desc\n",
        "queryFrequency": "PT6H",
        "queryPeriod": "PT6H",
        "severity": "High",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Collection",
          "CommandAndControl",
          "CredentialAccess",
          "DefenseEvasion",
          "Discovery",
          "Execution",
          "Exfiltration",
          "Impact",
          "InitialAccess",
          "LateralMovement",
          "Persistence"
        ],
        "techniques": [],
        "templateVersion": "1.0.1",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}