Name:Cisco AI Defense Repeated High Risk Activity id:45c5cf84-8ad0-4923-8332-a7fd3dab59d4 version:1 date:None author:Nasreddine Bencherchali, Splunk status:production type:TTP Description:Detects bursts of five or more distinct Cisco AI Defense event IDs, or three or more occurrences of the same event ID, matching prompt injection, code detection, PII, or PCI guardrails for the same application and connection within ten minutes.
Allowed PII/PCI prompt events are handled by Cisco AI Defense Allowed Sensitive Prompt.
These patterns can indicate iterative prompt-injection probing or repeated attempts to use an AI application to access restricted data or capabilities. Data_source:
-Cisco AI Defense Alerts
search:`cisco_ai_defense`
```Leave allowed PII/PCI prompt events to Cisco AI Defense Allowed Sensitive Prompt```
| eval is_allowed_sensitive_prompt=if(lower(event_action)="allow" AND lower(event_message_type)="prompt" AND mvfind('event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail_ruleset_type', "(?i)\\bPII\\b|personally identifiable information|\\bPCI\\b|payment card industry")>=0, 1, 0) | where is_allowed_sensitive_prompt=0
| eval guardrail_ruleset_type=mvjoin('event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail_ruleset_type', ", "), application_name=if(isnotnull('genai_application.application_name') AND len(trim('genai_application.application_name'))>0, 'genai_application.application_name', "unknown"), connection_name=if(isnotnull('connection.connection_name') AND len(trim('connection.connection_name'))>0, 'connection.connection_name', "unknown"), application_key=if(isnotnull(application_id) AND len(trim(application_id))>0, application_id, application_name), connection_key=if(isnotnull(connection_id) AND len(trim(connection_id))>0, connection_id, connection_name)
| where mvfind('event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail_ruleset_type', "(?i)prompt injection|code detection|\\bPII\\b|personally identifiable information|\\bPCI\\b|payment card industry")>=0
| bin _time span=10m
```Track repeated records with the same Cisco event ID separately from bursts of distinct event IDs``` | eventstats count as same_event_id_count by _time application_key connection_key event_id
| stats count as event_count dc(event_id) as distinct_event_count max(eval(if(isnotnull(event_id) AND len(trim(event_id))>0, same_event_id_count, 0))) as max_same_event_id_count values(eval(if(isnotnull(event_id) AND len(trim(event_id))>0 AND same_event_id_count>=3, event_id, null()))) as repeated_event_ids count(eval(lower(event_action)="allow")) as allowed_event_count count(eval(lower(event_action)="block")) as blocked_event_count values(event_id) as event_ids values(event_action) as event_actions values(event_message_type) as message_types values(policy.policy_name) as policy_names values(guardrail_ruleset_type) as guardrail_ruleset_types values(connection_name) as connection_names values(application_name) as application_names by _time application_key connection_key
| where distinct_event_count>=5 OR max_same_event_id_count>=3
how_to_implement:Install and configure the Cisco Security Cloud app to ingest Cisco AI Defense alerts into Splunk.
Confirm that extraction is enabled for the required fields as shown in the detection search.
Configure the "cisco_ai_defense" macro to match the index, source, and sourcetype used in your environment.
Adjust the five-distinct-event threshold, three-occurrence same-event-ID threshold, and ten-minute window as needed. known_false_positives:Automated testing, red-team exercises, application QA, or a popular shared application may generate repeated guardrail events.
Review whether the window contains allowed events and whether the activity was expected for the application and connection. References: drilldown_searches: name:'View the detection results for - "$application_key$"' search:'%original_detection_search% | search application_key="$application_key$"' earliest_offset:'$info_min_time$' latest_offset:'$info_max_time$' analytic_story:['Abuse of GenAI Systems and Applications', 'Critical Alerts']
