Expand every analytics rule domain to five examples

CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## Unreleased — 2.1.0
+
+- Expand every rule domain to five examples.
+- Add 28 analytics rules for a total of 35 across seven domains.
+- Extend AI, agent, identity, Purview, cloud, endpoint, and UEBA behavioral coverage.
+- Regenerate the rule catalog and coverage matrix.
+
 ## Unreleased — 2.0.0
 
 - Restructure the repository around root-level analytics rules.

README.md

@@ -19,15 +19,17 @@ flowchart LR
 
 ## Rule domains
 
-| Domain | Example coverage |
+| Domain | Five example behaviors |
 |---|---|
-| AI security | Repeated prompt-injection indicators |
-| Agent 365 | Risky or unauthorized agent tool use |
-| Identity | Password spraying |
-| Purview | AI activity correlated with mass file operations |
-| Cloud | Azure resource deletion |
-| Endpoint | Suspicious PowerShell execution |
-| UEBA | Privileged-identity anomaly |
+| AI security | Prompt injection, sensitive output, excessive tokens, system-prompt extraction, content-safety bypass |
+| Agent 365 | Unauthorized tools, privilege escalation, data transfer, abnormal volume, new risky connector |
+| Identity | Password spray, MFA fatigue, privileged role assignment, OAuth consent, emergency account use |
+| Purview | AI/file correlation, mass downloads, sensitive sharing, label downgrade, sharing spike |
+| Cloud | Resource deletion, Key Vault access, diagnostics deletion, public storage, NSG changes |
+| Endpoint | PowerShell, Office child shell, LOLBin retrieval, credential dumping, scheduled-task persistence |
+| UEBA | Privileged identity, newly observed identity, service account, unusual context, anomaly before role assignment |
+
+The catalog contains **35 analytics-rule examples: five per domain**.
 
 Browse the generated [rule catalog](docs/rule-catalog.md) for tables, severity, ATT&CK mappings, entities, and versions.
 

analytics-rules/agent-365/abnormal-agent-execution-volume.yaml

@@ -0,0 +1,53 @@
+id: 88428f48-7ed3-5071-8a36-264814e06a76
+name: Abnormal AI agent execution volume
+description: Detects an agent executing tools at a high volume during a short window.
+severity: Medium
+status: Available
+requiredDataConnectors:
+- connectorId: CustomLogsAma
+  dataTypes:
+  - AIToolExecution_CL
+queryFrequency: 30m
+queryPeriod: 1h
+triggerOperator: gt
+triggerThreshold: 0
+tactics:
+- Execution
+relevantTechniques:
+- T1059
+query: |
+  let ExecutionThreshold=100;
+  AIToolExecution_CL
+  | where TimeGenerated > ago(1h)
+  | extend UserPrincipalName=tostring(UserPrincipalName_s), AgentId=tostring(AgentId_s), ToolName=tostring(ToolName_s)
+  | summarize ExecutionCount=count(), Tools=make_set(ToolName,30) by UserPrincipalName, AgentId, bin(TimeGenerated,15m)
+  | where ExecutionCount >= ExecutionThreshold
+  | project TimeGenerated, UserPrincipalName, AgentId, ExecutionCount, Tools
+entityMappings:
+- entityType: Account
+  fieldMappings:
+  - identifier: FullName
+    columnName: UserPrincipalName
+customDetails:
+  AgentId: AgentId
+  ExecutionCount: ExecutionCount
+alertDetailsOverride:
+  alertDisplayNameFormat: Abnormal execution volume for agent {{AgentId}}
+  alertDescriptionFormat: '{{ExecutionCount}} executions were observed for {{UserPrincipalName}}.'
+eventGroupingSettings:
+  aggregationKind: AlertPerResult
+incidentConfiguration:
+  createIncident: true
+  groupingConfiguration:
+    enabled: true
+    reopenClosedIncident: false
+    lookbackDuration: 5h
+    matchingMethod: Selected
+    groupByEntities:
+    - Account
+    groupByAlertDetails: []
+    groupByCustomDetails: []
+suppressionDuration: 5h
+suppressionEnabled: false
+version: 1.0.0
+kind: Scheduled

analytics-rules/agent-365/agent-data-exfiltration.yaml

@@ -0,0 +1,55 @@
+id: c33315d5-f97a-5cd0-9420-54f6810009d0
+name: AI agent high-volume data transfer
+description: Detects high-volume tool results or outbound transfers associated with an AI agent.
+severity: High
+status: Available
+requiredDataConnectors:
+- connectorId: CustomLogsAma
+  dataTypes:
+  - AIToolExecution_CL
+queryFrequency: 30m
+queryPeriod: 1h
+triggerOperator: gt
+triggerThreshold: 0
+tactics:
+- Exfiltration
+relevantTechniques:
+- T1041
+query: |
+  let ByteThreshold=50000000;
+  AIToolExecution_CL
+  | where TimeGenerated > ago(1h)
+  | extend UserPrincipalName=tostring(UserPrincipalName_s), AgentId=tostring(AgentId_s), ToolName=tostring(ToolName_s), Bytes=tolong(OutputBytes_d), Destination=tostring(Destination_s)
+  | summarize EndTime=max(TimeGenerated), TotalBytes=sum(Bytes), Executions=count(), Tools=make_set(ToolName,20) by UserPrincipalName, AgentId, Destination
+  | where TotalBytes >= ByteThreshold
+  | extend TimeGenerated=EndTime
+  | project TimeGenerated, UserPrincipalName, AgentId, Destination, TotalBytes, Executions, Tools
+entityMappings:
+- entityType: Account
+  fieldMappings:
+  - identifier: FullName
+    columnName: UserPrincipalName
+customDetails:
+  AgentId: AgentId
+  Destination: Destination
+  TotalBytes: TotalBytes
+alertDetailsOverride:
+  alertDisplayNameFormat: High-volume transfer by agent {{AgentId}}
+  alertDescriptionFormat: Agent activity transferred {{TotalBytes}} bytes to {{Destination}}.
+eventGroupingSettings:
+  aggregationKind: AlertPerResult
+incidentConfiguration:
+  createIncident: true
+  groupingConfiguration:
+    enabled: true
+    reopenClosedIncident: false
+    lookbackDuration: 5h
+    matchingMethod: Selected
+    groupByEntities:
+    - Account
+    groupByAlertDetails: []
+    groupByCustomDetails: []
+suppressionDuration: 5h
+suppressionEnabled: false
+version: 1.0.0
+kind: Scheduled

analytics-rules/agent-365/agent-privilege-escalation.yaml

@@ -0,0 +1,57 @@
+id: d1750fa5-12e6-55ed-bf1b-485e1b2fe40a
+name: AI agent privilege escalation indicator
+description: Detects agent tool calls requesting or receiving elevated permissions without an approved workflow.
+severity: High
+status: Available
+requiredDataConnectors:
+- connectorId: CustomLogsAma
+  dataTypes:
+  - AIToolExecution_CL
+queryFrequency: 30m
+queryPeriod: 1h
+triggerOperator: gt
+triggerThreshold: 0
+tactics:
+- PrivilegeEscalation
+relevantTechniques:
+- T1098
+query: |
+  AIToolExecution_CL
+  | where TimeGenerated > ago(1h)
+  | extend UserPrincipalName=tostring(UserPrincipalName_s), SourceIP=tostring(SourceIP_s), AgentId=tostring(AgentId_s), ToolName=tostring(ToolName_s), Approval=tostring(ApprovalStatus_s), Privilege=tostring(RequestedPrivilege_s)
+  | where Privilege in~ ("Admin","Owner","GlobalAdmin") and Approval !~ "Approved"
+  | project TimeGenerated, UserPrincipalName, SourceIP, AgentId, ToolName, Approval, Privilege
+entityMappings:
+- entityType: Account
+  fieldMappings:
+  - identifier: FullName
+    columnName: UserPrincipalName
+- entityType: IP
+  fieldMappings:
+  - identifier: Address
+    columnName: SourceIP
+customDetails:
+  AgentId: AgentId
+  ToolName: ToolName
+  Privilege: Privilege
+alertDetailsOverride:
+  alertDisplayNameFormat: Agent {{AgentId}} requested elevated access
+  alertDescriptionFormat: '{{UserPrincipalName}} requested {{Privilege}} through {{ToolName}}.'
+eventGroupingSettings:
+  aggregationKind: AlertPerResult
+incidentConfiguration:
+  createIncident: true
+  groupingConfiguration:
+    enabled: true
+    reopenClosedIncident: false
+    lookbackDuration: 5h
+    matchingMethod: Selected
+    groupByEntities:
+    - Account
+    - IP
+    groupByAlertDetails: []
+    groupByCustomDetails: []
+suppressionDuration: 5h
+suppressionEnabled: false
+version: 1.0.0
+kind: Scheduled

analytics-rules/agent-365/new-high-risk-connector.yaml

@@ -0,0 +1,61 @@
+id: 779b8419-dc00-5ef3-8e0a-3e3617d2cb7a
+name: New high-risk connector used by AI agent
+description: Detects first-seen use of a high-risk connector by an agent compared with a 30-day baseline.
+severity: High
+status: Available
+requiredDataConnectors:
+- connectorId: CustomLogsAma
+  dataTypes:
+  - AIToolExecution_CL
+queryFrequency: 30m
+queryPeriod: 1h
+triggerOperator: gt
+triggerThreshold: 0
+tactics:
+- Execution
+- Collection
+relevantTechniques:
+- T1059
+query: |
+  let Recent=1h; let Baseline=30d;
+  let Known=AIToolExecution_CL | where TimeGenerated between (ago(Baseline)..ago(Recent)) | summarize by AgentId=tostring(AgentId_s), ToolName=tostring(ToolName_s);
+  AIToolExecution_CL
+  | where TimeGenerated > ago(Recent)
+  | extend AgentId=tostring(AgentId_s), ToolName=tostring(ToolName_s), UserPrincipalName=tostring(UserPrincipalName_s), RiskLevel=tostring(RiskLevel_s), SourceIP=tostring(SourceIP_s)
+  | where RiskLevel in~ ("High","Critical")
+  | join kind=leftanti Known on AgentId, ToolName
+  | project TimeGenerated, UserPrincipalName, SourceIP, AgentId, ToolName, RiskLevel
+entityMappings:
+- entityType: Account
+  fieldMappings:
+  - identifier: FullName
+    columnName: UserPrincipalName
+- entityType: IP
+  fieldMappings:
+  - identifier: Address
+    columnName: SourceIP
+customDetails:
+  AgentId: AgentId
+  ToolName: ToolName
+  RiskLevel: RiskLevel
+alertDetailsOverride:
+  alertDisplayNameFormat: New risky connector {{ToolName}} used by {{AgentId}}
+  alertDescriptionFormat: A first-seen high-risk connector was used by {{UserPrincipalName}}.
+eventGroupingSettings:
+  aggregationKind: AlertPerResult
+incidentConfiguration:
+  createIncident: true
+  groupingConfiguration:
+    enabled: true
+    reopenClosedIncident: false
+    lookbackDuration: 5h
+    matchingMethod: Selected
+    groupByEntities:
+    - Account
+    - IP
+    groupByAlertDetails: []
+    groupByCustomDetails: []
+suppressionDuration: 5h
+suppressionEnabled: false
+version: 1.0.0
+kind: Scheduled

analytics-rules/ai-security/content-safety-bypass.yaml

@@ -0,0 +1,59 @@
+id: 0a539120-dc39-5a74-931f-518c81906ce5
+name: Repeated AI content-safety blocks
+description: Detects repeated blocked or high-severity content-safety outcomes for the same user and application.
+severity: High
+status: Available
+requiredDataConnectors:
+- connectorId: CustomLogsAma
+  dataTypes:
+  - AIApp_CL
+queryFrequency: 30m
+queryPeriod: 1h
+triggerOperator: gt
+triggerThreshold: 0
+tactics:
+- DefenseEvasion
+relevantTechniques: []
+query: |
+  let Threshold=5;
+  AIApp_CL
+  | where TimeGenerated > ago(1h)
+  | extend UserPrincipalName=tostring(UserPrincipalName_s), SourceIP=tostring(SourceIP_s), Application=tostring(Application_s), SafetyResult=tostring(ContentSafetyResult_s)
+  | where SafetyResult in~ ("Blocked","High","Critical")
+  | summarize EndTime=max(TimeGenerated), Blocks=count(), Results=make_set(SafetyResult,10) by UserPrincipalName, SourceIP, Application
+  | where Blocks >= Threshold
+  | extend TimeGenerated=EndTime
+  | project TimeGenerated, UserPrincipalName, SourceIP, Application, Blocks, Results
+entityMappings:
+- entityType: Account
+  fieldMappings:
+  - identifier: FullName
+    columnName: UserPrincipalName
+- entityType: IP
+  fieldMappings:
+  - identifier: Address
+    columnName: SourceIP
+customDetails:
+  Application: Application
+  Blocks: Blocks
+alertDetailsOverride:
+  alertDisplayNameFormat: Repeated AI safety blocks for {{UserPrincipalName}}
+  alertDescriptionFormat: '{{Blocks}} blocked or high-severity events occurred in {{Application}}.'
+eventGroupingSettings:
+  aggregationKind: AlertPerResult
+incidentConfiguration:
+  createIncident: true
+  groupingConfiguration:
+    enabled: true
+    reopenClosedIncident: false
+    lookbackDuration: 5h
+    matchingMethod: Selected
+    groupByEntities:
+    - Account
+    - IP
+    groupByAlertDetails: []
+    groupByCustomDetails: []
+suppressionDuration: 5h
+suppressionEnabled: false
+version: 1.0.0
+kind: Scheduled

analytics-rules/ai-security/excessive-token-consumption.yaml

@@ -0,0 +1,54 @@
+id: c5823a8c-3462-533c-acaf-13e7510a7efd
+name: Abnormal AI token consumption
+description: Detects unusually high token consumption by a user and application during the rule window. Baseline thresholds by workload.
+severity: Medium
+status: Available
+requiredDataConnectors:
+- connectorId: CustomLogsAma
+  dataTypes:
+  - AIApp_CL
+queryFrequency: 30m
+queryPeriod: 1h
+triggerOperator: gt
+triggerThreshold: 0
+tactics:
+- Impact
+relevantTechniques:
+- T1496
+query: |
+  let TokenThreshold=100000;
+  AIApp_CL
+  | where TimeGenerated > ago(1h)
+  | extend UserPrincipalName=tostring(UserPrincipalName_s), Application=tostring(Application_s), Tokens=todouble(TokenCount_d), SourceIP=tostring(SourceIP_s)
+  | summarize TokenTotal=sum(Tokens), RequestCount=count(), SourceIPs=make_set(SourceIP,20) by UserPrincipalName, Application, bin(TimeGenerated,1h)
+  | where TokenTotal >= TokenThreshold
+  | project TimeGenerated, UserPrincipalName, Application, TokenTotal, RequestCount, SourceIPs
+entityMappings:
+- entityType: Account
+  fieldMappings:
+  - identifier: FullName
+    columnName: UserPrincipalName
+customDetails:
+  Application: Application
+  TokenTotal: TokenTotal
+  RequestCount: RequestCount
+alertDetailsOverride:
+  alertDisplayNameFormat: Abnormal AI consumption by {{UserPrincipalName}}
+  alertDescriptionFormat: '{{TokenTotal}} tokens were consumed in {{Application}}.'
+eventGroupingSettings:
+  aggregationKind: AlertPerResult
+incidentConfiguration:
+  createIncident: true
+  groupingConfiguration:
+    enabled: true
+    reopenClosedIncident: false
+    lookbackDuration: 5h
+    matchingMethod: Selected
+    groupByEntities:
+    - Account
+    groupByAlertDetails: []
+    groupByCustomDetails: []
+suppressionDuration: 5h
+suppressionEnabled: false
+version: 1.0.0
+kind: Scheduled