Vaikora - Behavioral anomaly detected

Back


Id	e61258ec-1a7f-454c-95b5-458a6edb1ea4
Rulename	Vaikora - Behavioral anomaly detected
Description	Identifies AI agent behavioral anomalies flagged by Vaikora with an anomaly score of 0.7 or above, indicating significant deviation from the agent’s established behavioral baseline.
Severity	Medium
Tactics	DefenseEvasion Execution
Techniques	T1059 T1027
Required data connectors	VaikoraSentinel
Kind	Scheduled
Query frequency	30m
Query period	1h
Trigger threshold	0
Trigger operator	GreaterThan
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Vaikora-Sentinel/Analytic Rules/Vaikora - Behavioral Anomaly Detected.yaml
Version	1.0.0
Arm template	e61258ec-1a7f-454c-95b5-458a6edb1ea4.json

KQL

Vaikora_AgentSignals_CL
| where TimeGenerated > ago(1h)
| where is_anomaly_b == true
| where anomaly_score_d >= 0.7
| summarize
    AnomalyCount = count(),
    MaxAnomalyScore = max(anomaly_score_d),
    AvgAnomalyScore = avg(anomaly_score_d),
    AnomalyReasons = make_set(anomaly_reason_s),
    ActionTypes = make_set(action_type_s)
  by AgentId = agent_id_s, Severity = severity_s
| extend
    ReasonList = strcat_array(AnomalyReasons, "; "),
    ActionList = strcat_array(ActionTypes, ", ")

YAML

queryPeriod: 1h
description: |
    Identifies AI agent behavioral anomalies flagged by Vaikora with an anomaly score of 0.7 or above, indicating significant deviation from the agent's established behavioral baseline.
relevantTechniques:
- T1059
- T1027
triggerThreshold: 0
customDetails:
  ActionTypes: ActionList
  AvgAnomalyScore: AvgAnomalyScore
  MaxAnomalyScore: MaxAnomalyScore
  AnomalyCount: AnomalyCount
  AnomalyReasons: ReasonList
id: e61258ec-1a7f-454c-95b5-458a6edb1ea4
queryFrequency: 30m
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Vaikora-Sentinel/Analytic Rules/Vaikora - Behavioral Anomaly Detected.yaml
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    groupByEntities:
    - Account
    matchingMethod: Selected
    enabled: true
    reopenClosedIncident: false
    lookbackDuration: 1h
query: |
  Vaikora_AgentSignals_CL
  | where TimeGenerated > ago(1h)
  | where is_anomaly_b == true
  | where anomaly_score_d >= 0.7
  | summarize
      AnomalyCount = count(),
      MaxAnomalyScore = max(anomaly_score_d),
      AvgAnomalyScore = avg(anomaly_score_d),
      AnomalyReasons = make_set(anomaly_reason_s),
      ActionTypes = make_set(action_type_s)
    by AgentId = agent_id_s, Severity = severity_s
  | extend
      ReasonList = strcat_array(AnomalyReasons, "; "),
      ActionList = strcat_array(ActionTypes, ", ")  
entityMappings:
- fieldMappings:
  - columnName: AgentId
    identifier: Name
  entityType: Account
eventGroupingSettings:
  aggregationKind: AlertPerResult
triggerOperator: GreaterThan
suppressionEnabled: false
tactics:
- DefenseEvasion
- Execution
status: Available
name: Vaikora - Behavioral anomaly detected
version: 1.0.0
severity: Medium
requiredDataConnectors:
- connectorId: VaikoraSentinel
  dataTypes:
  - Vaikora_AgentSignals_CL
kind: Scheduled
suppressionDuration: 30m

ARM