Detection: Cisco AI Defense Allowed Sensitive Prompt

Created: 2026-10-15 Last Updated: 2026-10-15 ID: 75f06fd6-2b31-4ca4-9aaf-56448c342e44 Author: Nasreddine Bencherchali, Splunk Type: TTP Product: Splunk Enterprise Security

Description

Detects Cisco AI Defense prompt events that were allowed and matched a privacy guardrail for personally identifiable information or payment card data. These events may indicate that sensitive information was submitted to an AI application and should be reviewed against the organization's data handling policy.

Search

 1`cisco_ai_defense`
 2event_action="allow"
 3event_message_type="prompt"
 4
 5
 6| eval guardrail_ruleset_type=mvjoin('event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail_ruleset_type', ", "),
 7
 8       guardrail_entity_name=mvjoin('event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_entity.guardrail_entity_name', ", "),
 9
10       application_name=if(isnotnull('genai_application.application_name') AND len(trim('genai_application.application_name'))>0, 'genai_application.application_name', "unknown"),
11
12       connection_name=if(isnotnull('connection.connection_name') AND len(trim('connection.connection_name'))>0, 'connection.connection_name', "unknown"),
13
14       application_key=if(isnotnull(application_id) AND len(trim(application_id))>0, application_id, application_name),
15
16       connection_key=if(isnotnull(connection_id) AND len(trim(connection_id))>0, connection_id, connection_name),
17
18       policy_name='policy.policy_name',
19
20       event_time=_time
21
22
23| where mvfind('event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail_ruleset_type', "(?i)\\bPII\\b
24|personally identifiable information
25|\\bPCI\\b
26|payment card industry")>=0
27
28
29| bin _time span=10m
30
31
32| stats count as event_count
33        dc(event_id) as distinct_event_count
34        min(event_time) as firstTime
35        max(event_time) as lastTime
36        values(event_id) as event_ids
37        values(guardrail_ruleset_type) as guardrail_ruleset_types
38        values(guardrail_entity_name) as guardrail_entity_names
39        values(policy_name) as policy_names
40        values(application_name) as application_names
41        values(connection_name) as connection_names
42    by _time application_key connection_key
43
44
45| `security_content_ctime(firstTime)`
46
47| `security_content_ctime(lastTime)`
48
49
50| table _time firstTime lastTime application_key application_names connection_key connection_names
51        distinct_event_count event_count event_ids guardrail_ruleset_types guardrail_entity_names policy_names
52
53
54| `cisco_ai_defense_allowed_sensitive_prompt_filter`

Data Source

Name	Platform	Sourcetype	Source
Cisco AI Defense Alerts	Other	`'cisco:ai:defense'`	`'not_applicable'`

Macros Used

Name	Value
security_content_ctime	`convert timeformat="%Y-%m-%dT%H:%M:%S" ctime($field$)`
cisco_ai_defense_allowed_sensitive_prompt_filter	`search *`

cisco_ai_defense_allowed_sensitive_prompt_filter is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Annotations

- MITRE ATT&CK

+ Kill Chain Phases

+ NIST

+ CIS

- Threat Actors

ID	Technique	Tactic

DE.CM

CIS 10

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Setting	Value
Disabled	true
Cron Schedule	`0 * * * *`
Earliest Time	`-70m@m`
Latest Time	`-10m@m`
Schedule Window	`auto`
Creates Finding (Notable)	Yes
Rule Title	`%name%`
Rule Description	`%description%`
Notable Event Fields	user, dest
Creates Intermediate Finding (Risk Event)	No

TTP detections generate a Finding (Notable) and may generate Intermediate Findings (Risk Events) for associated entities.

Implementation

Install and configure the Cisco Security Cloud app to ingest Cisco AI Defense alerts into Splunk with the cisco:ai:defense sourcetype. Confirm that extraction is enabled for the required fields as shown in the detection search. Configure the "cisco_ai_defense" macro to match the index, source, and sourcetype used in your environment. The search groups matching prompt events by application and connection in ten-minute windows to reduce duplicate findings.

Known False Positives

Authorized testing, demonstrations, synthetic data, or approved workflows may submit content that matches PII or PCI guardrails. Review the application, connection, policy, guardrail entity, and data handling requirements before treating an event as a policy violation.

Associated Analytic Story

Finding

Title	Entity Field	Entity Type	Risk Score
Cisco AI Defense allowed [$distinct_event_count$] sensitive prompt event(s) for application [$application_names$] and connection [$connection_names$] matched guardrail(s) [$guardrail_ruleset_types$].	application_key	other	50

Detection Testing

Test Type	Status	Dataset	Source	Sourcetype
Validation	✅ Passing	N/A	N/A	N/A
Unit	✅ Passing	Dataset	`not_applicable`	`cisco:ai:defense`
Integration	✅ Passing	Dataset	`not_applicable`	`cisco:ai:defense`

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub |

Version: 1