KQL Search

Query Details

Copilot Studio - Agent uses a model never seen before

Copilot Studio New Model First Seen

Query

let recentWindow=1h;
let baselineWindow=14d;
let recent=AppDependencies
| where TimeGenerated > ago(recentWindow)
| extend Agent=tostring(Properties["gen_ai.agent.name"]), Model=tolower(tostring(Properties["gen_ai.request.model"])), ConvId=tostring(Properties["gen_ai.conversation.id"]), AccountName=coalesce(tostring(Properties["user.email"]), tostring(Properties["user.id"]), tostring(Properties["gen_ai.agent.name"]), "unknown-agent")
| where isnotempty(Agent) and isnotempty(Model);
let baseline=AppDependencies
| where TimeGenerated between (ago(baselineWindow) .. ago(recentWindow))
| extend Agent=tostring(Properties["gen_ai.agent.name"]), Model=tolower(tostring(Properties["gen_ai.request.model"]))
| where isnotempty(Agent) and isnotempty(Model)
| distinct Agent, Model;
recent
| join kind=leftanti baseline on Agent, Model
| summarize Calls=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Conversations=make_set(ConvId, 10), AccountName=take_any(AccountName), ClientIP=take_any(ClientIP) by Agent, Model
| extend TimeGenerated=LastSeen, Signal="FIRST-SEEN MODEL FOR AGENT"
| project TimeGenerated, Signal, AccountName, ClientIP, Agent, Model, Calls, Conversations, FirstSeen, LastSeen
| order by LastSeen desc

Explanation

This query is designed to detect when a new model identifier is used by an agent in the Copilot Studio environment that hasn't been used by the same agent in the past 14 days. This can help identify unauthorized model usage, unapproved deployments, or changes in model routing. However, it doesn't necessarily indicate malicious activity, so further verification is needed.

Here's a breakdown of the query:

  1. Data Source: It uses data from the AppDependencies table in Application Insights.

  2. Time Frames:

    • Recent Window: Looks at data from the past hour.
    • Baseline Window: Compares this to data from the preceding 14 days.

  3. Process:

    • Recent Data: Collects recent model usage data, including agent name, model identifier, conversation ID, and account name.
    • Baseline Data: Collects similar data from the baseline period to establish what models have been used by each agent in the past 14 days.
    • Comparison: Identifies models used in the recent window that were not seen in the baseline window for the same agent.

  4. Output:

    • Provides details such as the number of calls, first and last seen times, conversation IDs, account name, and client IP for each new model usage.
    • Orders results by the most recent usage.

  5. Alert Configuration:

    • Generates an alert if any new model usage is detected.
    • Groups alerts by account for incident management.

  6. Severity and Tactics:

    • The alert severity is set to medium.
    • It is associated with tactics like Defense Evasion and Execution, relevant to techniques T1562 and T1059.

  7. Additional Settings:

    • The query runs every hour and is enabled by default.
    • It includes entity mappings for accounts, cloud applications, and IP addresses.

Overall, this query helps monitor and manage model usage within the Copilot Studio environment, ensuring compliance with approved deployments and detecting potential unauthorized activities.