KQL Search

Query Details

AI Agent Security Risk Inventory With Owner Attribution

Query

AgentsInfo
| where TimeGenerated > ago(30d)
| summarize arg_max(TimeGenerated, *) by AgentId
| extend RiskText = tostring(coalesce(
    column_ifexists("RiskText", ""),
    column_ifexists("RiskIndicators", "")
))
| extend RiskBag = parse_json(RiskText)
| mv-expand RiskId = bag_keys(RiskBag)
| extend Risk = RiskBag[tostring(RiskId)]
| extend
    RiskTitle = tostring(Risk["title"]),
    RiskSeverity = tostring(Risk["severity"]),
    RiskActive = tobool(Risk["isActive"]),
    RiskDescription = tostring(Risk["description"]),
    RiskUpdated = todatetime(Risk["lastUpdatedDateTime"])
| where isnotempty(RiskTitle)
| where isnotempty(RiskSeverity)
| where RiskSeverity !in~ (excludedRiskSeverity)
| where RiskTitle !in~ (excludedRiskTitle)
| mv-apply Evidence = Risk["displayEvidence"] on (
    where tostring(Evidence["title"]) =~ "Owner UPNs"
    | summarize OwnerUPN = strcat_array(make_set(tostring(Evidence["text"])), ", ")
)
| project
    TimeGenerated,
    Name,
    AgentId,
    Platform,
    OwnerUPN,
    RiskTitle,
    RiskSeverity,
    RiskActive,
    RiskDescription,
    RiskUpdated
| order by TimeGenerated desc

About this query

Explanation

This query is designed to create a current inventory of security risks associated with AI agents, focusing on the most recent risk indicators for each agent. Here's a simplified breakdown of what the query does:

  1. Source and Timeframe: It uses the AgentsInfo table to look at data from the last 30 days.

  2. Latest Record Selection: For each AI agent, it keeps only the most recent record by using the arg_max function based on the TimeGenerated timestamp.

  3. Risk Data Extraction: It extracts risk information from either the RiskText or RiskIndicators column, depending on which is available. This ensures compatibility with different table versions.

  4. JSON Parsing: The risk data is parsed as JSON, and each risk indicator is expanded into its own row. Key details like the risk's title, severity, active status, description, and last update time are extracted.

  5. Filtering: Risks without a title or severity are removed. Additionally, risks with specific severities or titles that are not of interest (defined by excludedRiskSeverity and excludedRiskTitle parameters) are filtered out.

  6. Owner Attribution: For each remaining risk, the query identifies the agent owner's User Principal Name (UPN) from the risk's evidence. If multiple entries exist, they are combined into a single, comma-separated list.

  7. Final Output: The query projects a list of relevant details, including the agent's name, ID, platform, owner, and risk details, sorted by the most recently seen agents.

This query is meant for inventory and tuning purposes, allowing analysts to focus on relevant risks by excluding known or accepted ones. It does not map to specific adversary techniques but helps maintain an up-to-date view of potential security issues with AI agents.