↳ GitHub sourceAnalytics ruleHigh

AIShield - Natural language processing AI model extraction high suspicious vulnerability detection

Description

This alert creates an incident when Natural language processing AI Model extraction high suspicious, high severity vulnerability detected from the AIShield.'

Rule type: Scheduled
Version: 1.0.1
Declared status: Available
Query frequency: 1h
Query period: 1h
Trigger: gt 0

Declared sources

Metadata from the source file. No dependencies inferred from KQL.

Connectors

BoschAIShield

Data types

AIShield

KQL query

Original query, unchanged.

AIShield
| where Message has 'Natural Language Processing AI Model Extraction Attack Identified'
| where Severity =~ 'High'
| where SuspiciousLevel =~ 'high suspicious attack'
| extend NTDomain = tostring(split(Computer, '\\')[0]), HostName = tostring(split(Computer, '.')[0])

Declared entities

HostIP

Source provenance

GitHub

Displayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.

File: Solutions/AIShield AI Security Monitoring/Analytic Rules/NaturalLanguageProcessingModelExtractionHighSuspiciousVulDetection.yaml ↗
Commit: 7ca9800 ↗
Source identifier: 4ec55816-e07b-45fc-b89e-917c93906540

Additional source files 2

Solutions/AIShield AI Security Monitoring/Analytic Rules/NaturalLanguageProcessingModelExtractionHighSuspiciousVulDetection.yamlsource ↗Solutions/AIShield AI Security Monitoring/Data/Solution_AIShield.jsonsolution-membership ↗

GSTEP / CATALOG TRACKING

Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC

GSTEP sync dates, separate from the source content’s publication dates.