Foundry - Sensitive data / secrets in agent prompt

Foundry Secrets In Prompt

Query

union isfuzzy=true
(AppDependencies
| extend ContentKey = strcat(OperationId, ":", Id),
    Agent = tostring(Properties["gen_ai.agent.name"]),
    Model = tostring(Properties["gen_ai.request.model"]),
    ConvId = tostring(Properties["gen_ai.conversation.id"]),
    ProjectId = tostring(Properties["microsoft.foundry.project.id"]),
    Input = tostring(Properties["gen_ai.input.messages"])),
(AppGenAIContent
| extend ContentKey = strcat(TraceId, ":", SpanId), Agent = tostring(AgentName),
    Model = tostring(ModelName), ConvId = tostring(Attributes["gen_ai.conversation.id"]),
    ProjectId = tostring(Attributes["microsoft.foundry.project.id"]),
    Input = tostring(InputMessages))
| where isnotempty(Input)
| summarize arg_max(TimeGenerated, *) by ContentKey
| extend
    HasAwsKey     = Input matches regex @"AKIA[0-9A-Z]{16}",
    HasPrivateKey = Input contains "-----BEGIN" and Input contains "PRIVATE KEY-----",
    HasJwt        = Input matches regex @"eyJ[A-Za-z0-9_\-]{10,}\.[A-Za-z0-9_\-]{10,}\.[A-Za-z0-9_\-]{10,}",
    HasCreditCard = Input matches regex @"\b(?:\d[ \-]?){13,16}\b",
    EmailCount    = array_length(extract_all(@"([A-Za-z0-9._%+\-]+@[A-Za-z0-9.\-]+\.[A-Za-z]{2,})", Input))
| where HasAwsKey or HasPrivateKey or HasJwt or HasCreditCard or EmailCount >= 10
| extend Signal = strcat(
    iff(HasAwsKey, "AWSAccessKey;", ""),
    iff(HasPrivateKey, "PrivateKey;", ""),
    iff(HasJwt, "JWT;", ""),
    iff(HasCreditCard, "CreditCardLike;", ""),
    iff(EmailCount >= 10, strcat("BulkEmails(", tostring(EmailCount), ");"), ""))
| extend AccountName = iff(isempty(Agent), "unknown-agent", Agent)
| project
    TimeGenerated, Signal, AccountName, Agent, Model, ProjectId,
    ConvId, EmailCount
| order by TimeGenerated desc

Explanation

This query is designed to detect potentially sensitive data being input into a Foundry or Agent Service request. It looks for specific types of sensitive information, such as:

AWS access keys
PEM private-key blocks
JSON Web Tokens (JWTs)
Credit card-like numbers
A large number of distinct email addresses (10 or more)

The query checks data from two sources: AppDependencies and AppGenAIContent. It combines these data sources and looks for any input that contains the specified sensitive information patterns using regular expressions.

If such data is found, it generates an alert with metadata about the incident, including the time it was generated, the type of sensitive data detected, the agent involved, the model used, the project ID, and the conversation ID. The query runs every hour and creates an incident if any sensitive data is detected.

The query is part of a broader security monitoring strategy, focusing on preventing credential access and data collection by identifying when sensitive information is inadvertently shared with AI agents. It is configured to group related alerts into a single incident to streamline incident management.