Techniques
Sample rules
Cisco AI Defense Security Alerts by Application Name
- source: splunk
- technicques:
Description
This analytic summarizes Cisco AI Defense events by application, connection, action, message direction, and severity over ten-minute intervals. Allowed responses flagged for privacy guardrails are handled by the dedicated sensitive-response detection. Allowed prompts flagged for privacy guardrails are handled by Cisco AI Defense Allowed Sensitive Prompt. Repeated prompt injection, code detection, PII, or PCI events are handled by the repeated high-risk activity detection.
Detection logic
`cisco_ai_defense`
| rename genai_application.application_name as application_name,
connection.connection_name as connection_name
| eval policy_name='policy.policy_name',
guardrail_ruleset_type=mvjoin('event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail_ruleset_type', ", "),
guardrail_entity_name=mvjoin('event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_entity.guardrail_entity_name', ", "),
action=lower(event_action), message_type=lower(event_message_type),
has_privacy=if(mvfind('event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail_ruleset_type', "(?i)\\bPII\\b
|personally identifiable information
|\\bPCI\\b
|payment card industry")>=0, 1, 0),
has_sensitive_response=if(message_type="response" AND has_privacy=1, 1, 0),
has_security=if(mvfind('event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail_ruleset_type', "(?i)prompt injection
|code detection")>=0, 1, 0)
```Prioritize allowed sensitive responses, then security and privacy guardrails```
| eval severity=case(
action="allow" AND has_sensitive_response=1, "critical",
action="block" AND has_sensitive_response=1, "high",
action="allow" AND has_security=1, "high",
action="block" AND has_security=1, "medium",
action="allow" AND has_privacy=1, "high",
action="block" AND has_privacy=1, "medium",
true(), "low"
)
| eval risk_score=case(
severity="critical", 100,
severity="high", 80,
severity="medium", 50,
severity="low", 20
)
| eval application_name=if(isnotnull(application_name) AND len(trim(application_name))>0, application_name, "unknown"),
connection_name=if(isnotnull(connection_name) AND len(trim(connection_name))>0, connection_name, "unknown"),
application_key=if(isnotnull(application_id) AND len(trim(application_id))>0, application_id, application_name),
connection_key=if(isnotnull(connection_id) AND len(trim(connection_id))>0, connection_id, connection_name),
is_high_risk=if(has_security=1 OR has_privacy=1, 1, 0),
is_allowed_sensitive_response=if(action="allow" AND has_sensitive_response=1, 1, 0),
is_allowed_sensitive_prompt=if(action="allow" AND message_type="prompt" AND has_privacy=1, 1, 0),
high_risk_event_id=if((has_security=1 OR has_privacy=1) AND is_allowed_sensitive_prompt=0, event_id, null()),
event_time=_time
| bin _time span=10m
```Use the same application/connection window and threshold as Cisco AI Defense Repeated High Risk Activity```
| eventstats count as same_high_risk_event_count by _time application_key connection_key high_risk_event_id
| eventstats dc(high_risk_event_id) as high_risk_event_count by _time application_key connection_key
```Leave allowed sensitive responses to Cisco AI Defense Allowed Sensitive Response, allowed sensitive prompts to Cisco AI Defense Allowed Sensitive Prompt, and repeated high-risk bursts to Cisco AI Defense Repeated High Risk Activity```
| where is_allowed_sensitive_response=0 AND is_allowed_sensitive_prompt=0 AND NOT (is_high_risk=1 AND (high_risk_event_count>=5 OR same_high_risk_event_count>=3))
| stats count as event_count
dc(event_id) as distinct_event_count
min(event_time) as firstTime
max(event_time) as lastTime
values(event_id) as event_ids
values(event_action) as event_actions
values(event_message_type) as message_types
values(resource_type) as resource_types
values(model.model_name) as model_names
values(application_name) as application_name
values(connection_name) as connection_name
values(policy_name) as policy_names
values(guardrail_ruleset_type) as guardrail_ruleset_types
values(guardrail_entity_name) as guardrail_entity_names
max(risk_score) as risk_score
by _time application_key connection_key action message_type severity
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| table _time firstTime lastTime application_key application_name connection_key connection_name
action message_type severity risk_score event_count distinct_event_count event_ids
resource_types model_names policy_names guardrail_ruleset_types guardrail_entity_names
| `cisco_ai_defense_security_alerts_by_application_name_filter`