↳ GitHub sourceAnalytics ruleMedium
Vaikora - Behavioral anomaly detected
Description
Identifies AI agent actions flagged as behavioral anomalies by Vaikora that fall outside the high or critical severity buckets but still represent statistically unusual activity worth investigation.
- Rule type
- Scheduled
- Version
- 1.0.1
- Declared status
- Available
- Query frequency
- 6h
- Query period
- 6h
- Trigger
- gt 0
Declared MITRE coverage
Declared sources
Metadata from the source file. No dependencies inferred from KQL.
Connectors
Data types
KQL query
Original query, unchanged.
Vaikora_AgentSignals_CL
| where TimeGenerated >= ago(6h)
| where is_anomaly_b == true
| where severity_s !in ("high", "critical")
| extend
ActionId = action_id_s,
AgentId = agent_id_s,
ActionType = action_type_s,
Severity = severity_s,
Status = status_s,
AnomalyScore = anomaly_score_d
| project TimeGenerated, ActionId, AgentId, ActionType, Severity, Status, AnomalyScore
| order by AnomalyScore desc, TimeGenerated desc
Declared entities
Related content
Links established from declared identifiers and solution manifests.
Source provenance
GitHubDisplayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.
- Commit
629d1d3↗- Source identifier
c0984707-0855-430e-9c36-5e2d0d0ce56f
GSTEP / CATALOG TRACKING
Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC