Vaikora - Behavioral anomaly detected

Vaikora_AgentSignals_CL
| where TimeGenerated >= ago(6h)
| where is_anomaly_b == true
| where severity_s !in ("high", "critical")
| extend
    ActionId     = action_id_s,
    AgentId      = agent_id_s,
    ActionType   = action_type_s,
    Severity     = severity_s,
    Status       = status_s,
    AnomalyScore = anomaly_score_d
| project TimeGenerated, ActionId, AgentId, ActionType, Severity, Status, AnomalyScore
| order by AnomalyScore desc, TimeGenerated desc

queryFrequency: 6h
entityMappings:
- fieldMappings:
  - columnName: AgentId
    identifier: Name
  entityType: Account
triggerThreshold: 0
triggerOperator: gt
severity: Medium
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Vaikora-AzureSecurityCenter/Analytic%20Rules/Vaikora%20-%20Anomaly%20Detection.yaml
alertDetailsOverride:
  alertDisplayNameFormat: 'Vaikora anomaly on agent {{agent_id_s}}: {{action_type_s}}'
  alertDescriptionFormat: Vaikora flagged a behavioral anomaly with score {{anomaly_score_d}}.
query: |
  Vaikora_AgentSignals_CL
  | where TimeGenerated >= ago(6h)
  | where is_anomaly_b == true
  | where severity_s !in ("high", "critical")
  | extend
      ActionId     = action_id_s,
      AgentId      = agent_id_s,
      ActionType   = action_type_s,
      Severity     = severity_s,
      Status       = status_s,
      AnomalyScore = anomaly_score_d
  | project TimeGenerated, ActionId, AgentId, ActionType, Severity, Status, AnomalyScore
  | order by AnomalyScore desc, TimeGenerated desc
tactics:
- Discovery
- LateralMovement
- Collection
- Exfiltration
queryPeriod: 6h
relevantTechniques: []
requiredDataConnectors:
- connectorId: VaikoraSecurityCenter
  dataTypes:
  - Vaikora_AgentSignals_CL
id: c0984707-0855-430e-9c36-5e2d0d0ce56f
kind: Scheduled
version: 1.0.1
description: |
  Identifies AI agent actions flagged as behavioral anomalies by Vaikora that fall outside the high or critical severity buckets but still represent statistically unusual activity worth investigation.
status: Available
name: Vaikora - Behavioral anomaly detected

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/c0984707-0855-430e-9c36-5e2d0d0ce56f')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/c0984707-0855-430e-9c36-5e2d0d0ce56f')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "Vaikora flagged a behavioral anomaly with score {{anomaly_score_d}}.",
          "alertDisplayNameFormat": "Vaikora anomaly on agent {{agent_id_s}}: {{action_type_s}}"
        },
        "alertRuleTemplateName": "c0984707-0855-430e-9c36-5e2d0d0ce56f",
        "customDetails": null,
        "description": "Identifies AI agent actions flagged as behavioral anomalies by Vaikora that fall outside the high or critical severity buckets but still represent statistically unusual activity worth investigation.\n",
        "displayName": "Vaikora - Behavioral anomaly detected",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "AgentId",
                "identifier": "Name"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Vaikora-AzureSecurityCenter/Analytic%20Rules/Vaikora%20-%20Anomaly%20Detection.yaml",
        "query": "Vaikora_AgentSignals_CL\n| where TimeGenerated >= ago(6h)\n| where is_anomaly_b == true\n| where severity_s !in (\"high\", \"critical\")\n| extend\n    ActionId     = action_id_s,\n    AgentId      = agent_id_s,\n    ActionType   = action_type_s,\n    Severity     = severity_s,\n    Status       = status_s,\n    AnomalyScore = anomaly_score_d\n| project TimeGenerated, ActionId, AgentId, ActionType, Severity, Status, AnomalyScore\n| order by AnomalyScore desc, TimeGenerated desc\n",
        "queryFrequency": "PT6H",
        "queryPeriod": "PT6H",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Collection",
          "Discovery",
          "Exfiltration",
          "LateralMovement"
        ],
        "techniques": [],
        "templateVersion": "1.0.1",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}