↳ GitHub sourceAnalytics ruleMedium

Vaikora - Agent policy violation

Description

Identifies AI agent actions explicitly blocked by a Vaikora policy. Repeated violations from the same agent may indicate prompt injection, policy circumvention, or a compromised workflow.

Rule type: Scheduled
Version: 1.0.0
Declared status: Available
Query frequency: 15m
Query period: 1h
Trigger: GreaterThan 0

Declared MITRE coverage

Declared sources

Metadata from the source file. No dependencies inferred from KQL.

Connectors

VaikoraSentinel

Data types

Vaikora_AgentSignals_CL

KQL query

Original query, unchanged.

Vaikora_AgentSignals_CL
| where TimeGenerated > ago(1h)
| where policy_decision_s == "block"
| summarize
    ViolationCount = count(),
    PolicyIds = make_set(policy_id_s),
    ActionTypes = make_set(action_type_s),
    ResourceTypes = make_set(resource_type_s),
    MaxAnomalyScore = max(anomaly_score_d),
    Severities = make_set(severity_s),
    LogHashes = make_set(log_hash_s)
  by AgentId = agent_id_s
| extend
    PolicyList = strcat_array(PolicyIds, ", "),
    ActionList = strcat_array(ActionTypes, ", "),
    ResourceList = strcat_array(ResourceTypes, ", ")
| where ViolationCount >= 1

Declared entities

Account

Source provenance

GitHub

Displayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.

File: Solutions/Vaikora-Sentinel/Analytic Rules/Vaikora - Agent Policy Violation.yaml ↗
Commit: 629d1d3 ↗
Source identifier: 54262ad1-f346-4246-a13f-9557595ff7bd

Additional source files 2

Solutions/Vaikora-Sentinel/Analytic Rules/Vaikora - Agent Policy Violation.yamlsource ↗Solutions/Vaikora-Sentinel/Data/Solution_Vaikora.jsonsolution-membership ↗

GSTEP / CATALOG TRACKING

Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC

GSTEP sync dates, separate from the source content’s publication dates.