Name:Cisco AI Defense Security Alerts by Application Name id:105e4a69-ec55-49fc-be1f-902467435ea8 version:8 date:None author:Bhavin Patel, Nasreddine Bencherchali, Splunk status:production type:Anomaly Description:This analytic summarizes Cisco AI Defense events by application, connection, action, message direction, and severity over ten-minute intervals.
Allowed responses flagged for privacy guardrails are handled by the dedicated sensitive-response detection.
Allowed prompts flagged for privacy guardrails are handled by Cisco AI Defense Allowed Sensitive Prompt.
Repeated prompt injection, code detection, PII, or PCI events are handled by the repeated high-risk activity detection. Data_source:
-Cisco AI Defense Alerts
search:`cisco_ai_defense`
| rename genai_application.application_name as application_name, connection.connection_name as connection_name
```Prioritize allowed sensitive responses, then security and privacy guardrails```
| eval severity=case( action="allow" AND has_sensitive_response=1, "critical", action="block" AND has_sensitive_response=1, "high", action="allow" AND has_security=1, "high", action="block" AND has_security=1, "medium", action="allow" AND has_privacy=1, "high", action="block" AND has_privacy=1, "medium", true(), "low" )
| eval application_name=if(isnotnull(application_name) AND len(trim(application_name))>0, application_name, "unknown"), connection_name=if(isnotnull(connection_name) AND len(trim(connection_name))>0, connection_name, "unknown"), application_key=if(isnotnull(application_id) AND len(trim(application_id))>0, application_id, application_name), connection_key=if(isnotnull(connection_id) AND len(trim(connection_id))>0, connection_id, connection_name), is_high_risk=if(has_security=1 OR has_privacy=1, 1, 0), is_allowed_sensitive_response=if(action="allow" AND has_sensitive_response=1, 1, 0), is_allowed_sensitive_prompt=if(action="allow" AND message_type="prompt" AND has_privacy=1, 1, 0), high_risk_event_id=if((has_security=1 OR has_privacy=1) AND is_allowed_sensitive_prompt=0, event_id, null()), event_time=_time
| bin _time span=10m
```Use the same application/connection window and threshold as Cisco AI Defense Repeated High Risk Activity``` | eventstats count as same_high_risk_event_count by _time application_key connection_key high_risk_event_id | eventstats dc(high_risk_event_id) as high_risk_event_count by _time application_key connection_key
```Leave allowed sensitive responses to Cisco AI Defense Allowed Sensitive Response, allowed sensitive prompts to Cisco AI Defense Allowed Sensitive Prompt, and repeated high-risk bursts to Cisco AI Defense Repeated High Risk Activity``` | where is_allowed_sensitive_response=0 AND is_allowed_sensitive_prompt=0 AND NOT (is_high_risk=1 AND (high_risk_event_count>=5 OR same_high_risk_event_count>=3))
| stats count as event_count dc(event_id) as distinct_event_count min(event_time) as firstTime max(event_time) as lastTime values(event_id) as event_ids values(event_action) as event_actions values(event_message_type) as message_types values(resource_type) as resource_types values(model.model_name) as model_names values(application_name) as application_name values(connection_name) as connection_name values(policy_name) as policy_names values(guardrail_ruleset_type) as guardrail_ruleset_types values(guardrail_entity_name) as guardrail_entity_names max(risk_score) as risk_score by _time application_key connection_key action message_type severity
how_to_implement:Install and configure the Cisco Security Cloud app to ingest Cisco AI Defense alerts into Splunk with the cisco:ai:defense sourcetype.
Confirm that extraction is enabled for the required fields as shown in the detection search.
Configure the cisco_ai_defense macro to match the index, source, and sourcetype used in your environment. known_false_positives:False positives may vary based on Cisco AI Defense configuration; monitor and filter out the alerts that are not relevant to your environment. References: -https://www.robustintelligence.com/blog-posts/prompt-injection-attack-on-gpt-4 -https://docs.aws.amazon.com/prescriptive-guidance/latest/llm-prompt-engineering-best-practices/common-attacks.html drilldown_searches: name:'View the detection results for - "$application_name$"' search:'%original_detection_search% | search application_name = "$application_name$"' earliest_offset:'$info_min_time$' latest_offset:'$info_max_time$' name:'View risk events for the last 7 days for - "$application_name$"' search:'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$application_name$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset:'7d' latest_offset:'0' analytic_story:['Abuse of GenAI Systems and Applications', 'Critical Alerts']
tests: name:'True Positive Test' attack_data: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/cisco_ai_defense_alerts/cisco_ai_defense_alerts.json source: not_applicable sourcetype: cisco:ai:defense description:'We are dynamically creating the risk_score field based on the severity of the alert in the SPL and that supersedes the risk score set in the detection.' test_type:'unit' manual_test:None
