Detection rules › Kusto

Vaikora - High severity AI agent action detected

This is a third-party alert feed, not a detection over modeled telemetry. The vendor product raised the finding; this rule forwards it into the SIEM. It is searchable for reference but is excluded from the detection-rule browse and the ATT&CK coverage matrix.

Status: available
Severity: high
Time window: 1h
Group by: AgentId, Severity
Source: github.com/Azure/Azure-Sentinel

Identifies AI agent actions from Vaikora classified as high or critical severity. These events may indicate an agent operating outside safe parameters or triggering policy thresholds.

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1059` Command and Scripting Interpreter
Privilege Escalation	`T1078` Valid Accounts `T1548` Abuse Elevation Control Mechanism

Rule body

id: 15c49777-7cb7-4746-8064-6fa4c7a73df8
name: Vaikora - High severity AI agent action detected
description: |
  Identifies AI agent actions from Vaikora classified as high or critical severity. These events may indicate an agent operating outside safe parameters or triggering policy thresholds.
severity: High
status: Available
requiredDataConnectors:
  - connectorId: VaikoraSentinel
    dataTypes:
      - Vaikora_AgentSignals_CL
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: GreaterThan
triggerThreshold: 0
tactics:
  - Impact
  - Execution
  - PrivilegeEscalation
relevantTechniques:
  - T1059
  - T1078
  - T1548
query: |
  Vaikora_AgentSignals_CL
  | where TimeGenerated > ago(1h)
  | where severity_s in ("high", "critical")
  | summarize
      ActionCount = count(),
      MaxAnomalyScore = max(anomaly_score_d),
      Actions = make_set(action_type_s),
      PolicyDecisions = make_set(policy_decision_s),
      ResourceTypes = make_set(resource_type_s),
      LogHashes = make_set(log_hash_s)
    by AgentId = agent_id_s, Severity = severity_s
  | extend
      ActionList = strcat_array(Actions, ", "),
      PolicyList = strcat_array(PolicyDecisions, ", "),
      ResourceList = strcat_array(ResourceTypes, ", ")
suppressionDuration: 1h
suppressionEnabled: false
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: true
    reopenClosedIncident: false
    lookbackDuration: 1h
    matchingMethod: Selected
    groupByEntities:
      - Account
eventGroupingSettings:
  aggregationKind: AlertPerResult
customDetails:
  MaxAnomalyScore: MaxAnomalyScore
  ActionCount: ActionCount
  Actions: ActionList
  PolicyDecisions: PolicyList
  ResourceTypes: ResourceList
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: Name
        columnName: AgentId
version: 1.0.0
kind: Scheduled

Stages and Predicates

Stage 1: `source`

Vaikora_AgentSignals_CL

Stage 2: `where`

| where TimeGenerated > ago(1h)

Stage 3: `where`

| where severity_s in ("high", "critical")

Stage 4: `summarize`

| summarize
    ActionCount = count(),
    MaxAnomalyScore = max(anomaly_score_d),
    Actions = make_set(action_type_s),
    PolicyDecisions = make_set(policy_decision_s),
    ResourceTypes = make_set(resource_type_s),
    LogHashes = make_set(log_hash_s)
  by AgentId = agent_id_s, Severity = severity_s

Stage 5: `extend`

| extend
    ActionList = strcat_array(Actions, ", "),
    PolicyList = strcat_array(PolicyDecisions, ", "),
    ResourceList = strcat_array(ResourceTypes, ", ")

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`severity_s`	in	`critical` `high`	`field:"okta::severity" kind:in`

Output fields

These fields are emitted when the rule matches.

Field	Source
`ActionCount`	`summarize`
`Actions`	`summarize`
`AgentId`	`summarize`
`LogHashes`	`summarize`
`MaxAnomalyScore`	`summarize`
`PolicyDecisions`	`summarize`
`ResourceTypes`	`summarize`
`Severity`	`summarize`
`ActionList`	`extend`
`PolicyList`	`extend`
`ResourceList`	`extend`

Vaikora - High severity AI agent action detected

MITRE ATT&CK coverage

Rule body

Stages and Predicates

Stage 1: source

Stage 2: where

Stage 3: where

Stage 4: summarize