KQL Search

Query Details

Microsoft 365 Copilot - Unsafe active content in response

Copilot Unsafe Active Content In Response

Query

CopilotActivity
| where RecordType == "CopilotInteraction"
| extend Response=tostring(LLMEventData.Response), ConversationId=tostring(LLMEventData.ConversationId)
| where isnotempty(Response)
| extend ActiveContent=extract(@"(?i)(</?script\b|<(?:iframe|embed|object)\b|on(?:click|load|error|mouse\w*|change|input)\s*=|(?:href|src)\s*=\s*[""']?javascript\s*:|data\s*:\s*(?:text/html|application/javascript|image/svg\+xml)|&#(?:60|62|x3[cCeEfF]);)", 0, Response)
| where isnotempty(ActiveContent)
| extend Signal="UNSAFE ACTIVE CONTENT EMITTED"
| project TimeGenerated, Signal, ActiveContent, AgentId, AgentName, ActorName, ActorUserId, ConversationId, SrcIpAddr, TenantId
| order by TimeGenerated desc

Explanation

This query is designed to monitor Microsoft 365 Copilot activities for potentially unsafe content. Here's a simple breakdown:

  • Purpose: It detects potentially dangerous active content, such as HTML scripts, event handlers, or executable links, in responses generated by Microsoft 365 Copilot. This is important because such content could pose security risks if executed by a client.

  • Severity: The alert is classified as "Medium," indicating a moderate level of concern.

  • Data Source: It uses data from the "MicrosoftCopilot" connector, specifically looking at "CopilotActivity" data.

  • Frequency: The query runs every hour and checks data from the past hour.

  • Trigger: An alert is triggered if any unsafe content is detected (i.e., more than zero occurrences).

  • Detection Logic:

    • It filters activities to those labeled as "CopilotInteraction."
    • It extracts and checks the response content for patterns that match unsafe active content, such as scripts or JavaScript URIs.
    • If such content is found, it marks it with a signal indicating "UNSAFE ACTIVE CONTENT EMITTED."

  • Output: The query outputs details like the time of the event, the unsafe content detected, and information about the agent and user involved.

  • Entity Mapping: It maps detected events to entities like Cloud Applications, Accounts, and IP addresses for better context.

  • Incident Management: If unsafe content is detected, an incident is created. Incidents can be grouped by account or cloud application, and closed incidents can be reopened if similar issues are detected within a 12-hour window.

  • Tags and Version: The query is tagged with relevant keywords for categorization and is versioned as 1.0.0. Overall, this query helps in identifying and managing potential security risks associated with active content in Microsoft 365 Copilot responses.