Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

AIShield - Image classification AI Model Evasion low suspicious vulnerability detection

Back
Idc4bedb3c-4fb8-4b1c-af5b-8229bd25f521
RulenameAIShield - Image classification AI Model Evasion low suspicious vulnerability detection
DescriptionThis alert creates an incident when Image classification AI Model Evasion low suspicious, high severity vulnerability detected from the AIShield.
SeverityHigh
Required data connectorsBoschAIShield
KindScheduled
Query frequency1h
Query period1h
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/AIShield AI Security Monitoring/Analytic Rules/ImageClassficationModelEvasionLowSuspiciousVulnDetection.yaml
Version1.0.4
Arm templatec4bedb3c-4fb8-4b1c-af5b-8229bd25f521.json
Deploy To Azure
AIShield
| where Message has 'Image Classification AI Model Evasion Attack Identified'
| where Severity =~ 'Medium'
| where SuspiciousLevel =~ 'low suspicious attack'
| extend NTDomain = tostring(split(Computer, '\\')[0]), HostName = tostring(split(Computer, '.')[0])
alertDetailsOverride:
  alertTacticsColumnName: 
  alertSeverityColumnName: Severity
  alertDisplayNameFormat: AIShield - Image Classification AI Model Evasion low suspicious vulnerability detected.
  alertDescriptionFormat: |
        This query detects Image Classification AI Model Evasion low suspicious, medium severity alert from AIShield generated at {{TimeGenerated}}.\n\nPlease check the source for more information and investigate further.
requiredDataConnectors:
- connectorId: BoschAIShield
  dataTypes:
  - AIShield
tactics: []
description: |
    'This alert creates an incident when Image classification AI Model Evasion low suspicious, high severity vulnerability detected from the AIShield.'
query: |
  AIShield
  | where Message has 'Image Classification AI Model Evasion Attack Identified'
  | where Severity =~ 'Medium'
  | where SuspiciousLevel =~ 'low suspicious attack'
  | extend NTDomain = tostring(split(Computer, '\\')[0]), HostName = tostring(split(Computer, '.')[0])  
id: c4bedb3c-4fb8-4b1c-af5b-8229bd25f521
triggerOperator: gt
eventGroupingSettings:
  aggregationKind: SingleAlert
relevantTechniques: []
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/AIShield AI Security Monitoring/Analytic Rules/ImageClassficationModelEvasionLowSuspiciousVulnDetection.yaml
queryFrequency: 1h
severity: High
entityMappings:
- fieldMappings:
  - columnName: HostName
    identifier: HostName
  - columnName: NTDomain
    identifier: NTDomain
  entityType: Host
- fieldMappings:
  - columnName: SourceName
    identifier: Address
  entityType: IP
name: AIShield - Image classification AI Model Evasion low suspicious vulnerability detection
queryPeriod: 1h
kind: Scheduled
triggerThreshold: 0
version: 1.0.4
status: Available
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/c4bedb3c-4fb8-4b1c-af5b-8229bd25f521')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/c4bedb3c-4fb8-4b1c-af5b-8229bd25f521')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "This query detects Image Classification AI Model Evasion low suspicious, medium severity alert from AIShield generated at {{TimeGenerated}}.\\n\\nPlease check the source for more information and investigate further.\n",
          "alertDisplayNameFormat": "AIShield - Image Classification AI Model Evasion low suspicious vulnerability detected.",
          "alertSeverityColumnName": "Severity",
          "alertTacticsColumnName": null
        },
        "alertRuleTemplateName": "c4bedb3c-4fb8-4b1c-af5b-8229bd25f521",
        "customDetails": null,
        "description": "'This alert creates an incident when Image classification AI Model Evasion low suspicious, high severity vulnerability detected from the AIShield.'\n",
        "displayName": "AIShield - Image classification AI Model Evasion low suspicious vulnerability detection",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Host",
            "fieldMappings": [
              {
                "columnName": "HostName",
                "identifier": "HostName"
              },
              {
                "columnName": "NTDomain",
                "identifier": "NTDomain"
              }
            ]
          },
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "SourceName",
                "identifier": "Address"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "SingleAlert"
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/AIShield AI Security Monitoring/Analytic Rules/ImageClassficationModelEvasionLowSuspiciousVulnDetection.yaml",
        "query": "AIShield\n| where Message has 'Image Classification AI Model Evasion Attack Identified'\n| where Severity =~ 'Medium'\n| where SuspiciousLevel =~ 'low suspicious attack'\n| extend NTDomain = tostring(split(Computer, '\\\\')[0]), HostName = tostring(split(Computer, '.')[0])\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "severity": "High",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [],
        "techniques": [],
        "templateVersion": "1.0.4",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}