KQL Search

Query Details

Azure Dev Ops High Volume Activity Via MCP Server

Query

let LookbackTime = 1h;
let ThresholdAPIcalls = 50; // Define your threshold
ADOAuditLogs
| where TimeGenerated > ago(LookbackTime)
| where UserAgent startswith "AzureDevOps.MCP"
| summarize 
    Starttime = min(TimeGenerated),
    Endtime = max(TimeGenerated),
    TotalOperations = count(),
    UniqueAreas = dcount(Area),
    UniqueOperations = dcount(OperationName),
    TargetProjects = make_set(ProjectName, 10),
    OperationsList = make_set(OperationName, 20),
    UserAgents = make_set(UserAgent, 5)
    by ActorUPN, IPAddress, ClientId
| extend IsHighVolume = iff(TotalOperations > ThresholdAPIcalls, true, false)
| where IsHighVolume or UniqueAreas > 3
| project 
    Starttime, 
    Endtime, 
    ActorUPN, 
    IPAddress, 
    TotalOperations, 
    UniqueAreas, 
    TargetProjects, 
    OperationsList, 
    UserAgents,
    IsHighVolume

About this query

Explanation

This query is designed to monitor Azure DevOps activities that are performed through the MCP Server, which is a tool that allows AI agents to interact with Azure DevOps on behalf of users. The query focuses on identifying potentially suspicious activities that could indicate misuse or compromise of an identity or token.

Here's a simplified breakdown of what the query does:

  1. Time Frame: It looks at activities within the past hour.

  2. User Agent Filtering: It specifically filters for operations where the user agent starts with "AzureDevOps.MCP", indicating they are performed via the MCP Server.

  3. Data Aggregation: For each unique combination of actor (user), source IP address, and client ID, it aggregates data to calculate:

    • The time range of the activities.
    • The total number of operations performed.
    • The number of distinct audit areas and operations involved.
    • The projects affected and the names of the operations performed.

  4. Thresholds: It flags results where:

    • The total number of operations exceeds 50 (or a custom threshold).
    • Activities span more than three different audit areas, suggesting broad exploration rather than focused tasks.

  5. Output: The query outputs details such as the start and end time of activities, the actor's user principal name, IP address, total operations, unique areas, affected projects, operation names, and whether the activity volume is considered high.

  6. Customization: Users can adjust the lookback time and operation threshold to fit their environment. They can also allowlist known users or client IDs to avoid false positives from legitimate heavy usage.

This query helps in identifying unusual or potentially malicious activities in Azure DevOps, especially those involving automated tools or AI agents.