KQL Search

Query Details

Copilot - Jailbreak Detection

Copilot Jailbreak Detected

Query

CopilotActivity
| extend Parsed = parse_json(LLMEventData)
| mv-expand Resource = Parsed.AccessedResources
| extend Action = tostring(parse_json(Resource.Action))
| extend Id = tostring(parse_json(Resource.id))
| extend Name = tostring(parse_json(Resource.Name))
| extend Type = tostring(parse_json(Resource.Type))
| project TimeGenerated, Action, Id, Name, Type, SrcIpAddr, Workload, AppHost, AppIdentity
| where Name == @"JailBreak"

About this query

Explanation

This KQL query is designed to detect and retrieve events related to "jailbreak" attempts in Microsoft Copilot, which is an AI-powered tool. Here's a simple breakdown of what the query does:

  1. Data Source: It looks at the CopilotActivity table, which contains records of interactions with Copilot.

  2. Filtering:

    • The query specifically filters for records where the RecordType is "CopilotInteraction", indicating that these are interactions with the Copilot tool.
    • It then parses the LLMEventData field to extract JSON data and focuses on the Messages within this data.

  3. Jailbreak Detection:

    • It checks each message to see if a jailbreak attempt was detected by converting the JailbreakDetected field to a boolean.
    • The query filters to only include messages where JailbreakDetected is true, meaning a jailbreak attempt was identified.

  4. Sorting: The results are ordered by the time the event was generated, with the most recent events appearing first.

  5. Additional Log Entry:

    • Another log entry is provided, which also looks at the CopilotActivity table.
    • It parses the LLMEventData to extract accessed resources and checks if any resource name matches "JailBreak".
    • This log entry projects various fields like TimeGenerated, Action, Id, Name, Type, and others, providing additional context about the jailbreak attempt.

Overall, this query is part of a testing phase to monitor and detect jailbreak attempts in interactions with Microsoft Copilot, helping to ensure the security and integrity of the AI tool.