automated testing, red-team exercises, application qa, or a popular shared application may generate repeated guardrail events. review whether the window contains allowed events and whether the activity was expected for the application and connection.

splunk

Techniques

Sample rules

Cisco AI Defense Repeated High Risk Activity

source: splunk
technicques:

Description

Detects bursts of five or more distinct Cisco AI Defense event IDs, or three or more occurrences of the same event ID, matching prompt injection, code detection, PII, or PCI guardrails for the same application and connection within ten minutes. Allowed PII/PCI prompt events are handled by Cisco AI Defense Allowed Sensitive Prompt. These patterns can indicate iterative prompt-injection probing or repeated attempts to use an AI application to access restricted data or capabilities.

Detection logic

`cisco_ai_defense`

```Leave allowed PII/PCI prompt events to Cisco AI Defense Allowed Sensitive Prompt```


| eval is_allowed_sensitive_prompt=if(lower(event_action)="allow" AND lower(event_message_type)="prompt" AND mvfind('event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail_ruleset_type', "(?i)\\bPII\\b
|personally identifiable information
|\\bPCI\\b
|payment card industry")>=0, 1, 0)

| where is_allowed_sensitive_prompt=0


| eval guardrail_ruleset_type=mvjoin('event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail_ruleset_type', ", "),
       application_name=if(isnotnull('genai_application.application_name') AND len(trim('genai_application.application_name'))>0, 'genai_application.application_name', "unknown"),
       connection_name=if(isnotnull('connection.connection_name') AND len(trim('connection.connection_name'))>0, 'connection.connection_name', "unknown"),
       application_key=if(isnotnull(application_id) AND len(trim(application_id))>0, application_id, application_name),
       connection_key=if(isnotnull(connection_id) AND len(trim(connection_id))>0, connection_id, connection_name)


| where mvfind('event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail_ruleset_type', "(?i)prompt injection
|code detection
|\\bPII\\b
|personally identifiable information
|\\bPCI\\b
|payment card industry")>=0


| bin _time span=10m

```Track repeated records with the same Cisco event ID separately from bursts of distinct event IDs```

| eventstats count as same_event_id_count by _time application_key connection_key event_id


| stats count as event_count
        dc(event_id) as distinct_event_count
        max(eval(if(isnotnull(event_id) AND len(trim(event_id))>0, same_event_id_count, 0))) as max_same_event_id_count
        values(eval(if(isnotnull(event_id) AND len(trim(event_id))>0 AND same_event_id_count>=3, event_id, null()))) as repeated_event_ids
        count(eval(lower(event_action)="allow")) as allowed_event_count
        count(eval(lower(event_action)="block")) as blocked_event_count
        values(event_id) as event_ids
        values(event_action) as event_actions
        values(event_message_type) as message_types
        values(policy.policy_name) as policy_names
        values(guardrail_ruleset_type) as guardrail_ruleset_types
        values(connection_name) as connection_names
        values(application_name) as application_names
    by _time application_key connection_key


| where distinct_event_count>=5 OR max_same_event_id_count>=3


| table _time application_key application_names connection_key connection_names
        event_count distinct_event_count max_same_event_id_count repeated_event_ids
        allowed_event_count blocked_event_count event_actions message_types policy_names
        guardrail_ruleset_types event_ids


| `cisco_ai_defense_repeated_high_risk_activity_filter`