Detection rules › Kusto

Vaikora - Behavioral anomaly detected

This is a third-party alert feed, not a detection over modeled telemetry. The vendor product raised the finding; this rule forwards it into the SIEM. It is searchable for reference but is excluded from the detection-rule browse and the ATT&CK coverage matrix.

Status: available
Severity: medium
Time window: 6h
Source: github.com/Azure/Azure-Sentinel

Identifies AI agent actions flagged as behavioral anomalies by Vaikora that fall outside the high or critical severity buckets but still represent statistically unusual activity worth investigation.

MITRE ATT&CK coverage

Tactic	Techniques
Discovery	No specific technique
Lateral Movement	No specific technique
Collection	No specific technique
Exfiltration	No specific technique

Rule body

id: c0984707-0855-430e-9c36-5e2d0d0ce56f
name: Vaikora - Behavioral anomaly detected
description: |
  Identifies AI agent actions flagged as behavioral anomalies by Vaikora that fall outside the high or critical severity buckets but still represent statistically unusual activity worth investigation.
severity: Medium
requiredDataConnectors:
  - connectorId: VaikoraSecurityCenter
    dataTypes:
      - Vaikora_AgentSignals_CL
queryFrequency: 6h
queryPeriod: 6h
triggerOperator: gt
triggerThreshold: 0
status: Available
tactics:
  - Discovery
  - LateralMovement
  - Collection
  - Exfiltration
relevantTechniques: []
query: |
  Vaikora_AgentSignals_CL
  | where TimeGenerated >= ago(6h)
  | where is_anomaly_b == true
  | where severity_s !in ("high", "critical")
  | extend
      ActionId     = action_id_s,
      AgentId      = agent_id_s,
      ActionType   = action_type_s,
      Severity     = severity_s,
      Status       = status_s,
      AnomalyScore = anomaly_score_d
  | project TimeGenerated, ActionId, AgentId, ActionType, Severity, Status, AnomalyScore
  | order by AnomalyScore desc, TimeGenerated desc
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: Name
        columnName: AgentId
alertDetailsOverride:
  alertDisplayNameFormat: "Vaikora anomaly on agent {{agent_id_s}}: {{action_type_s}}"
  alertDescriptionFormat: "Vaikora flagged a behavioral anomaly with score {{anomaly_score_d}}."
version: 1.0.1
kind: Scheduled

Stages and Predicates

Stage 1: `source`

Vaikora_AgentSignals_CL

Stage 2: `where`

| where TimeGenerated >= ago(6h)

Stage 3: `where`

| where is_anomaly_b == true

Stage 4: `where`

| where severity_s !in ("high", "critical")

Stage 5: `extend`

| extend
    ActionId     = action_id_s,
    AgentId      = agent_id_s,
    ActionType   = action_type_s,
    Severity     = severity_s,
    Status       = status_s,
    AnomalyScore = anomaly_score_d

Stage 6: `project`

| project TimeGenerated, ActionId, AgentId, ActionType, Severity, Status, AnomalyScore

Stage 7: `sort`

| order by AnomalyScore desc, TimeGenerated desc

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`severity_s`	in	`critical`, `high`	`excludes:severity_s` `field:"severity_s" value:"critical"` `field:"severity_s" value:"high"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`is_anomaly_b`	eq	`true`	`field:"is_anomaly_b" kind:eq value:"true"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`ActionId`	`project`
`ActionType`	`project`
`AgentId`	`project`
`AnomalyScore`	`project`
`Severity`	`project`
`Status`	`project`
`TimeGenerated`	`project`

Vaikora - Behavioral anomaly detected

MITRE ATT&CK coverage

Rule body

Stages and Predicates

Stage 1: source

Stage 2: where

Stage 3: where

Stage 4: where

Stage 5: extend

Stage 6: project

Stage 7: sort