detection.wiki

Detection rules › Kusto

Guardian- No LLM Output Policy Violation Detection

Status
available
Severity
low
Time window
1h
Source
github.com/Azure/Azure-Sentinel

'This alert creates an incident when No LLM Output Policy Violation detected from the Guardian.'

Rule body

id: c0598d69-221e-4235-a1e4-bfd57ada8ce5
name: Guardian- No LLM Output Policy Violation Detection
description: |
  'This alert creates an incident when No LLM Output Policy Violation detected from the Guardian.'
severity: Low
status: Available
requiredDataConnectors:
  - connectorId: BoschAIShield
    dataTypes:
      - Guardian
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics: []
relevantTechniques: []
query: |
  Guardian
  | where PolicyViolatedControlFeature =~ 'No LLM Output'
  | where Severity =~ 'Low'
entityMappings:
  - entityType: Host
    fieldMappings:
      - identifier: HostName
        columnName: HostName
      - identifier: NTDomain
        columnName: NTDomain
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: SourceIP
eventGroupingSettings:
  aggregationKind: SingleAlert
alertDetailsOverride:
  alertDisplayNameFormat: Guardian- No LLM Output Policy Violation detection
  alertDescriptionFormat: |
    This query detects No LLM Output Policy Violation detected from the Guardian generated at {{TimeGenerated}}.\n\nPlease check the source for more information and investigate further.
  alertTacticsColumnName: null
  alertSeverityColumnName: Severity
version: 1.0.0
kind: Scheduled

Stages and Predicates

Stage 1: source

Guardian

Stage 2: where

| where PolicyViolatedControlFeature =~ 'No LLM Output'

Stage 3: where

| where Severity =~ 'Low'

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
PolicyViolatedControlFeatureeq
  • No LLM Output
field:"PolicyViolatedControlFeature" kind:eq value:"No LLM Output"
Severityeq
  • Low
field:"Severity" kind:eq value:"Low"