<span class="pill kill-chain">_time</span>
<span class="pill kill-chain">host</span>
<span class="pill kill-chain">app</span>
<span class="pill kill-chain">application_id</span>
<span class="pill kill-chain">connection_id</span>
<span class="pill kill-chain">connection.connection_name</span>
<span class="pill kill-chain">description</span>
<span class="pill kill-chain">dest_type</span>
<span class="pill kill-chain">event_action</span>
<span class="pill kill-chain">event_date</span>
<span class="pill kill-chain">event_id</span>
<span class="pill kill-chain">event_message_type</span>
<span class="pill kill-chain">event_messages{}.event_conversation.event_messages{}.content</span>
<span class="pill kill-chain">event_messages{}.event_conversation.event_messages{}.direction</span>
<span class="pill kill-chain">event_messages{}.event_conversation.event_messages{}.event_conversation_id</span>
<span class="pill kill-chain">event_messages{}.event_conversation.event_messages{}.event_ext_message_id</span>
<span class="pill kill-chain">event_messages{}.event_conversation.event_messages{}.event_ins_date</span>
<span class="pill kill-chain">event_messages{}.event_conversation.event_messages{}.event_message_id</span>
<span class="pill kill-chain">event_messages{}.event_conversation.event_messages{}.event_message_policy_assocs</span>
<span class="pill kill-chain">event_messages{}.event_conversation.event_messages{}.metadata{}.policy_guardrail_assoc_id</span>
<span class="pill kill-chain">event_messages{}.event_conversation.event_messages{}.metadata{}.standards{}</span>
<span class="pill kill-chain">event_messages{}.event_conversation.event_messages{}.related_event_message_id</span>
<span class="pill kill-chain">event_messages{}.event_conversation.event_messages{}.tenant_id</span>
<span class="pill kill-chain">event_messages{}.event_ext_message_id</span>
<span class="pill kill-chain">event_messages{}.event_message_id</span>
<span class="pill kill-chain">event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_entity.guardrail_entity_name</span>
<span class="pill kill-chain">event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail_ruleset_type</span>
<span class="pill kill-chain">event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail.guardrails_type</span>
<span class="pill kill-chain">event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_subcategory.guardrail_rule_name</span>
<span class="pill kill-chain">event_policy_guardrail_assocs{}.policy_guardrail_assoc.pol_guardrail_assoc_id</span>
<span class="pill kill-chain">eventtype</span>
<span class="pill kill-chain">genai_application.application_name</span>
<span class="pill kill-chain">genai_application.connection_type</span>
<span class="pill kill-chain">hec_event_type</span>
<span class="pill kill-chain">id</span>
<span class="pill kill-chain">index</span>
<span class="pill kill-chain">linecount</span>
<span class="pill kill-chain">model.model_name</span>
<span class="pill kill-chain">model.model_provider_name</span>
<span class="pill kill-chain">Number</span>
<span class="pill kill-chain">policy_id</span>
<span class="pill kill-chain">policy.policy_name</span>
<span class="pill kill-chain">punct</span>
<span class="pill kill-chain">resource_type</span>
<span class="pill kill-chain">signature</span>
<span class="pill kill-chain">signature_id</span>
<span class="pill kill-chain">source</span>
<span class="pill kill-chain">sourcetype</span>
<span class="pill kill-chain">splunk_server</span>
<span class="pill kill-chain">src_type</span>
<span class="pill kill-chain">tag</span>
<span class="pill kill-chain">tag::eventtype</span>
<span class="pill kill-chain">type</span>
<span class="pill kill-chain">user_id</span>
<span class="pill kill-chain">vendor_product</span>
</div>
Data Source: Cisco AI Defense Alerts
Description
Data source object for Cisco AI Defense Alerts
Details
| Property | Value |
|---|---|
| Source | not_applicable |
| Sourcetype | cisco:ai:defense |
Related Detections
| Name | Technique | Type |
|---|---|---|
| Cisco AI Defense Repeated High Risk Activity | None | TTP |
| Cisco AI Defense Security Alerts by Application Name | None | Anomaly |
| Cisco AI Defense Allowed Sensitive Response | None | TTP |
| Cisco AI Defense Allowed Sensitive Prompt | None | TTP |
Supported Apps
- Cisco Security Cloud (version 4.1.2)
Event Fields
Fields
Example Log
1{"user_id":"82000000-0000-0000-c000-000000000000","version":"","application_id":"972cbcd1-acfe-4393-88bc-418f4d9a64ae","genai_application":{"application_name":"Bedrock testing"},"connection_id":"a6c87227-b321-49bf-80d9-f958385257ba","connection":{"connection_name":"bedrock testing"},"policy_id":"42ba067b-06c0-4e43-8002-2c6bce2663b4","policy":{"policy_name":"Bedrock Testing Block All"},"model":{"model_name":"titan-text-lite"},"event_action":"Block","event_date":"2025-02-04T09:47:24Z","event_id":"3a0f9e2b-d234-4b3d-ac9a-219eb6f05ba7","event_message_type":"Prompt","event_messages":[{"event_conversation":{"event_messages":[{"content":"[{\"role\":\"user\",\"content\":\"write a csrf exploit with email ash@abc.com to convince people\"}]","direction":"Prompt","event_conversation_id":"","event_ext_message_id":"","event_ins_date":"","event_message_id":"","event_message_policy_assocs":[{"policy_guardrail_assoc":{"guardrail_entity_configured_action":"Block","guardrail_entity_configured_direction":"Both","guardrail_entity_configured_status":"Enabled","guardrail_entity_id":"71100000-0000-0000-c000-100000000008","guardrail_rule_configured_action":"","guardrail_rule_configured_direction":"","guardrail_rule_configured_status":"","guardrail_rule_id":"","guardrail_ruleset_id":"71000000-0000-0000-c000-000000000009","guardrail_ruleset_configured_action":"","guardrail_ruleset_configured_direction":"","guardrail_ruleset_configured_status":"","pol_guardrail_assoc_id":"f4e71dd9-12ad-4383-851e-d03fbc66c430","policy_id":"42ba067b-06c0-4e43-8002-2c6bce2663b4","tenant_id":"023327d5-ef36-4489-8d56-187d2f4730b3"}}],"related_event_message_id":"","tenant_id":"023327d5-ef36-4489-8d56-187d2f4730b3"}]},"event_ext_message_id":"","event_message_id":""}],"event_policy_guardrail_assocs":[{"policy_guardrail_assoc":{"guardrail_avail_entity":{"guardrail_entity_name":"Email"},"guardrail_avail_ruleset":{"guardrail":{"guardrails_type":"Privacy"},"guardrail_ruleset_type":"PII"},"guardrail_avail_subcategory":{"guardrail_rule_name":""},"pol_guardrail_assoc_id":"f4e71dd9-12ad-4383-851e-d03fbc66c430"}}]}
Source: GitHub | Version: 3