Detection rules › Kusto

Vaikora - High severity AI agent action

This is a third-party alert feed, not a detection over modeled telemetry. The vendor product raised the finding; this rule forwards it into the SIEM. It is searchable for reference but is excluded from the detection-rule browse and the ATT&CK coverage matrix.

Status: available
Severity: high
Time window: 6h
Source: github.com/Azure/Azure-Sentinel

Identifies high or critical severity AI agent actions ingested from Vaikora in the last 6 hours.

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	No specific technique
Execution	No specific technique
Persistence	No specific technique
Stealth	No specific technique
Credential Access	No specific technique
Discovery	No specific technique
Lateral Movement	No specific technique
Collection	No specific technique
Command & Control	No specific technique
Exfiltration	No specific technique
Impact	No specific technique

Rule body

id: ac3ec787-fd49-4e93-88cc-aaa9b31061ac
name: Vaikora - High severity AI agent action
description: |
  Identifies high or critical severity AI agent actions ingested from Vaikora in the last 6 hours.
severity: High
requiredDataConnectors:
  - connectorId: VaikoraSecurityCenter
    dataTypes:
      - Vaikora_AgentSignals_CL
queryFrequency: 6h
queryPeriod: 6h
triggerOperator: gt
triggerThreshold: 0
status: Available
tactics:
  - InitialAccess
  - Execution
  - Persistence
  - DefenseEvasion
  - CredentialAccess
  - Discovery
  - LateralMovement
  - Collection
  - CommandAndControl
  - Exfiltration
  - Impact
relevantTechniques: []
query: |
  Vaikora_AgentSignals_CL
  | where TimeGenerated >= ago(6h)
  | where severity_s in ("high", "critical")
  | extend
      ActionId     = action_id_s,
      AgentId      = agent_id_s,
      ActionType   = action_type_s,
      Severity     = severity_s,
      Status       = status_s,
      IsAnomaly    = is_anomaly_b,
      AnomalyScore = anomaly_score_d
  | project TimeGenerated, ActionId, AgentId, ActionType, Severity, Status, IsAnomaly, AnomalyScore
  | order by TimeGenerated desc
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: Name
        columnName: AgentId
alertDetailsOverride:
  alertDisplayNameFormat: "Vaikora {{severity_s}} agent action: {{action_type_s}}"
  alertDescriptionFormat: "Vaikora detected a {{severity_s}} severity action on agent {{agent_id_s}}."
  alertSeverityColumnName: severity_s
version: 1.0.1
kind: Scheduled

Stages and Predicates

Stage 1: `source`

Vaikora_AgentSignals_CL

Stage 2: `where`

| where TimeGenerated >= ago(6h)

Stage 3: `where`

| where severity_s in ("high", "critical")

Stage 4: `extend`

| extend
    ActionId     = action_id_s,
    AgentId      = agent_id_s,
    ActionType   = action_type_s,
    Severity     = severity_s,
    Status       = status_s,
    IsAnomaly    = is_anomaly_b,
    AnomalyScore = anomaly_score_d

Stage 5: `project`

| project TimeGenerated, ActionId, AgentId, ActionType, Severity, Status, IsAnomaly, AnomalyScore

Stage 6: `sort`

| order by TimeGenerated desc

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`severity_s`	in	`critical` `high`	`field:"okta::severity" kind:in`

Output fields

These fields are emitted when the rule matches.

Field	Source
`ActionId`	`project`
`ActionType`	`project`
`AgentId`	`project`
`AnomalyScore`	`project`
`IsAnomaly`	`project`
`Severity`	`project`
`Status`	`project`
`TimeGenerated`	`project`

Vaikora - High severity AI agent action

MITRE ATT&CK coverage

Rule body

Stages and Predicates

Stage 1: source

Stage 2: where

Stage 3: where

Stage 4: extend

Stage 5: project

Stage 6: sort