Copilot Studio Inter Agent Permission Mismatch

Query

let baselineWindow=14d;
let recentWindow=1h;
let calleeBaseline=AppDependencies
| where TimeGenerated between (ago(baselineWindow) .. ago(recentWindow))
| extend Agent=tolower(tostring(Properties["gen_ai.agent.name"])), ToolName=tolower(tostring(Properties["gen_ai.tool.name"]))
| where isnotempty(Agent) and isnotempty(ToolName)
| distinct Agent, ToolName;
let crossInvocations=AppDependencies
| where TimeGenerated > ago(recentWindow)
| extend Caller=tolower(tostring(Properties["gen_ai.agent.name"])), ConvId=tostring(Properties["gen_ai.conversation.id"]), ToolName=tolower(tostring(Properties["gen_ai.tool.name"])), ToolType=tolower(tostring(Properties["gen_ai.tool.type"])), Callee=tolower(tostring(coalesce(Properties["gen_ai.tool.target_agent"], Properties["microsoft.agent.target_agent.name"], Properties["gen_ai.tool.name"])))
| where ToolType == "agent" or ToolName has "connected_agent" or ToolName has "agent_call"
| project Caller, ConvId, Callee, InvocationTime=TimeGenerated;
let calleeUsage=AppDependencies
| where TimeGenerated > ago(recentWindow)
| extend Agent=tolower(tostring(Properties["gen_ai.agent.name"])), ConvId=tostring(Properties["gen_ai.conversation.id"]), ToolName=tolower(tostring(Properties["gen_ai.tool.name"])), ToolType=tolower(tostring(Properties["gen_ai.tool.type"]))
| where isnotempty(Agent) and isnotempty(ToolName)
| project Agent, ConvId, ToolName, ToolType, ToolTime=TimeGenerated, ClientIP;
crossInvocations
| join kind=inner calleeUsage on ConvId
| where Agent == Callee or Agent has Callee or Callee has Agent
| where ToolTime between (InvocationTime .. (InvocationTime + 30m))
| join kind=leftanti calleeBaseline on Agent, ToolName
| summarize NewToolHits=count(), NewTools=make_set(ToolName, 16), NewToolTypes=make_set(ToolType, 8), FirstSeen=min(ToolTime), LastSeen=max(ToolTime), Caller=take_any(Caller), ClientIP=take_any(ClientIP) by Agent, ConvId
| where NewToolHits >= 1 and (array_length(NewTools) >= 2 or NewToolTypes has_any ("code_interpreter", "shell", "exec", "sql", "email", "http", "deploy", "azure_write"))
| extend TimeGenerated=LastSeen, AccountName=Agent, Signal="INTER-AGENT PERMISSION MISMATCH"
| project TimeGenerated, Signal, AccountName, Caller, Agent, ConvId, NewToolHits, NewTools, NewToolTypes, ClientIP, FirstSeen, LastSeen
| order by NewToolHits desc

Explanation

This query is designed to detect potential security issues related to inter-agent communication within a system. Here's a simplified breakdown:

Purpose: The query identifies instances where a delegated sub-agent uses tools that are not part of its usual 14-day activity baseline after being invoked by another agent in the same conversation. This could indicate a "confused deputy" problem or a breach of trust between agents.
Severity: The alert is classified as medium severity, indicating a moderate level of concern.
Data Source: It uses data from Application Insights, specifically focusing on application dependencies.
Frequency and Period: The query runs every hour and examines data from the past 14 days.
Detection Logic:
- It establishes a baseline of tools used by each agent over the past 14 days.
- It identifies recent cross-agent invocations within the last hour.
- It checks if the invoked agent uses any new tools not seen in its baseline.
- An alert is triggered if the agent uses at least two new tools or one sensitive tool type (like code interpreters, shell, SQL, etc.).
Output: The query outputs details such as the time of the event, the involved agents, the conversation ID, the new tools used, and the client IP address.
Alert and Incident Management: If the conditions are met, an alert is generated, and an incident is created. The system can group incidents by account and reopen closed incidents if similar activity is detected within a day.
Tags and Metadata: The query is tagged for easy identification and categorization, indicating its relevance to AI, inter-agent communication, and trust escalation issues.

Overall, this query helps in monitoring and maintaining the security and integrity of agent interactions within a system by flagging unusual or unauthorized tool usage.