Vaikora - Behavioral anomaly detected

Back


Id	e61258ec-1a7f-454c-95b5-458a6edb1ea4
Rulename	Vaikora - Behavioral anomaly detected
Description	Identifies AI agent behavioral anomalies flagged by Vaikora with an anomaly score of 0.7 or above, indicating significant deviation from the agent’s established behavioral baseline.
Severity	Medium
Tactics	DefenseEvasion Execution
Techniques	T1059 T1027
Required data connectors	VaikoraSentinel
Kind	Scheduled
Query frequency	30m
Query period	1h
Trigger threshold	0
Trigger operator	GreaterThan
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Vaikora-Sentinel/Analytic Rules/Vaikora - Behavioral Anomaly Detected.yaml
Version	1.0.0
Arm template	e61258ec-1a7f-454c-95b5-458a6edb1ea4.json

KQL

Vaikora_AgentSignals_CL
| where TimeGenerated > ago(1h)
| where is_anomaly_b == true
| where anomaly_score_d >= 0.7
| summarize
    AnomalyCount = count(),
    MaxAnomalyScore = max(anomaly_score_d),
    AvgAnomalyScore = avg(anomaly_score_d),
    AnomalyReasons = make_set(anomaly_reason_s),
    ActionTypes = make_set(action_type_s)
  by AgentId = agent_id_s, Severity = severity_s
| extend
    ReasonList = strcat_array(AnomalyReasons, "; "),
    ActionList = strcat_array(ActionTypes, ", ")

YAML

version: 1.0.0
id: e61258ec-1a7f-454c-95b5-458a6edb1ea4
relevantTechniques:
- T1059
- T1027
requiredDataConnectors:
- connectorId: VaikoraSentinel
  dataTypes:
  - Vaikora_AgentSignals_CL
triggerOperator: GreaterThan
entityMappings:
- fieldMappings:
  - columnName: AgentId
    identifier: Name
  entityType: Account
name: Vaikora - Behavioral anomaly detected
queryFrequency: 30m
triggerThreshold: 0
customDetails:
  AvgAnomalyScore: AvgAnomalyScore
  AnomalyCount: AnomalyCount
  MaxAnomalyScore: MaxAnomalyScore
  AnomalyReasons: ReasonList
  ActionTypes: ActionList
description: |
    Identifies AI agent behavioral anomalies flagged by Vaikora with an anomaly score of 0.7 or above, indicating significant deviation from the agent's established behavioral baseline.
status: Available
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Vaikora-Sentinel/Analytic Rules/Vaikora - Behavioral Anomaly Detected.yaml
suppressionEnabled: false
queryPeriod: 1h
severity: Medium
suppressionDuration: 30m
kind: Scheduled
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    matchingMethod: Selected
    reopenClosedIncident: false
    enabled: true
    lookbackDuration: 1h
    groupByEntities:
    - Account
tactics:
- DefenseEvasion
- Execution
query: |
  Vaikora_AgentSignals_CL
  | where TimeGenerated > ago(1h)
  | where is_anomaly_b == true
  | where anomaly_score_d >= 0.7
  | summarize
      AnomalyCount = count(),
      MaxAnomalyScore = max(anomaly_score_d),
      AvgAnomalyScore = avg(anomaly_score_d),
      AnomalyReasons = make_set(anomaly_reason_s),
      ActionTypes = make_set(action_type_s)
    by AgentId = agent_id_s, Severity = severity_s
  | extend
      ReasonList = strcat_array(AnomalyReasons, "; "),
      ActionList = strcat_array(ActionTypes, ", ")  
eventGroupingSettings:
  aggregationKind: AlertPerResult

ARM