↳ GitHub sourceAnalytics ruleHigh
Copilot - Jailbreak Attempt Detected
Description
'Detects jailbreak attempts in Copilot interactions where users are trying to bypass Copilot guardrails and security controls.
This rule identifies prompt injection and LLM abuse scenarios that could lead to initial access, credential access, or system impact.'
- Rule type
- Scheduled
- Version
- 1.0.0
- Declared status
- Available
- Query frequency
- 5m
- Query period
- 5m
- Trigger
- gt 0
Declared MITRE coverage
Declared sources
Metadata from the source file. No dependencies inferred from KQL.
Connectors
Data types
KQL query
Original query, unchanged.
CopilotActivity
| where RecordType == "CopilotInteraction"
| where LLMEventData has "JailbreakDetected"
| extend Data = parse_json(LLMEventData)
| extend Jailbreak = tostring(Data.Messages[0].JailbreakDetected)
| where Jailbreak == "true"
| project TimeGenerated, ActorName, AIModelName, Jailbreak
Declared entities
Related content
Links established from declared identifiers and solution manifests.
Source provenance
GitHubDisplayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.
- Commit
9800e51↗- Source identifier
e5f6a7b8-c9d0-41e2-f3a4-b5c6d7e8f9a0
Additional source files 1
Solutions/Microsoft Copilot/Analytic Rules/CopilotJailbreakAttempt.yamlsource ↗GSTEP / CATALOG TRACKING
Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC