Detection: Cisco AI Defense Repeated High Risk Activity

 1`cisco_ai_defense`
 2
 3```Leave allowed PII/PCI prompt events to Cisco AI Defense Allowed Sensitive Prompt```
 4
 5
 6| eval is_allowed_sensitive_prompt=if(lower(event_action)="allow" AND lower(event_message_type)="prompt" AND mvfind('event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail_ruleset_type', "(?i)\\bPII\\b
 7|personally identifiable information
 8|\\bPCI\\b
 9|payment card industry")>=0, 1, 0)
10
11| where is_allowed_sensitive_prompt=0
12
13
14| eval guardrail_ruleset_type=mvjoin('event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail_ruleset_type', ", "),
15       application_name=if(isnotnull('genai_application.application_name') AND len(trim('genai_application.application_name'))>0, 'genai_application.application_name', "unknown"),
16       connection_name=if(isnotnull('connection.connection_name') AND len(trim('connection.connection_name'))>0, 'connection.connection_name', "unknown"),
17       application_key=if(isnotnull(application_id) AND len(trim(application_id))>0, application_id, application_name),
18       connection_key=if(isnotnull(connection_id) AND len(trim(connection_id))>0, connection_id, connection_name)
19
20
21| where mvfind('event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail_ruleset_type', "(?i)prompt injection
22|code detection
23|\\bPII\\b
24|personally identifiable information
25|\\bPCI\\b
26|payment card industry")>=0
27
28
29| bin _time span=10m
30
31```Track repeated records with the same Cisco event ID separately from bursts of distinct event IDs```
32
33| eventstats count as same_event_id_count by _time application_key connection_key event_id
34
35
36| stats count as event_count
37        dc(event_id) as distinct_event_count
38        max(eval(if(isnotnull(event_id) AND len(trim(event_id))>0, same_event_id_count, 0))) as max_same_event_id_count
39        values(eval(if(isnotnull(event_id) AND len(trim(event_id))>0 AND same_event_id_count>=3, event_id, null()))) as repeated_event_ids
40        count(eval(lower(event_action)="allow")) as allowed_event_count
41        count(eval(lower(event_action)="block")) as blocked_event_count
42        values(event_id) as event_ids
43        values(event_action) as event_actions
44        values(event_message_type) as message_types
45        values(policy.policy_name) as policy_names
46        values(guardrail_ruleset_type) as guardrail_ruleset_types
47        values(connection_name) as connection_names
48        values(application_name) as application_names
49    by _time application_key connection_key
50
51
52| where distinct_event_count>=5 OR max_same_event_id_count>=3
53
54
55| table _time application_key application_names connection_key connection_names
56        event_count distinct_event_count max_same_event_id_count repeated_event_ids
57        allowed_event_count blocked_event_count event_actions message_types policy_names
58        guardrail_ruleset_types event_ids
59
60
61| `cisco_ai_defense_repeated_high_risk_activity_filter`