Automated NIST AI RMF lookup table update

lookups/csv/detection_subcategory_map.csv

@@ -23,11 +23,9 @@ MCP,MCP Server,MCP Github Suspicious Operation,production,Hunting,Suspicious MCP
 MCP,MCP Server,MCP Postgres Suspicious Query,production,Hunting,Suspicious MCP Activities,MEASURE,Measure 2.7,high,generated_rule,AI security and resilience evaluation signal
 MCP,MCP Server,MCP Prompt Injection,production,TTP,Suspicious MCP Activities,MEASURE,Measure 2.6|Measure 2.7,high,generated_rule,Prompt-behavior and harmful-content measurement signal; AI security and resilience evaluation signal
 MCP,MCP Server,MCP Sensitive System File Search,production,Hunting,Suspicious MCP Activities,MEASURE,Measure 2.10,high,generated_rule,Sensitive information or data-protection signal
-Ollama,Ollama Server,Ollama Abnormal Network Connectivity,experimental,Anomaly,Suspicious Ollama Activities,MAP,Map 4.1,high,generated_rule,"AI component, model, or service discovery signal"
-Ollama,Ollama Server,Ollama Abnormal Service Crash Availability Attack,experimental,Anomaly,Suspicious Ollama Activities,MANAGE,Manage 4.1,high,generated_rule,Post-deployment monitoring and response signal
-Ollama,Ollama Server,Ollama Excessive API Requests,experimental,Anomaly,Suspicious Ollama Activities,MEASURE|MANAGE,Measure 2.4|Manage 4.1,high,generated_rule,Production behavior monitoring signal; Post-deployment monitoring and response signal
-Ollama,Ollama Server,Ollama Possible API Endpoint Scan Reconnaissance,experimental,Anomaly,Suspicious Ollama Activities,MAP,Map 4.1,high,generated_rule,"AI component, model, or service discovery signal"
-Ollama,Ollama Server,Ollama Possible Memory Exhaustion Resource Abuse,experimental,Anomaly,Suspicious Ollama Activities,MEASURE|MANAGE,Measure 2.4|Manage 4.1,high,generated_rule,Production behavior monitoring signal; Post-deployment monitoring and response signal
-Ollama,Ollama Server,Ollama Possible Model Exfiltration Data Leakage,experimental,Anomaly,Suspicious Ollama Activities,MEASURE,Measure 2.10,high,generated_rule,Sensitive information or data-protection signal
-Ollama,Ollama Server,Ollama Possible RCE via Model Loading,experimental,Anomaly,Suspicious Ollama Activities,MEASURE|MANAGE,Measure 2.7|Manage 4.3,high,generated_rule,AI security and resilience evaluation signal; Incident tracking or response signal
-Ollama,Ollama Server,Ollama Suspicious Prompt Injection Jailbreak,experimental,Anomaly,Suspicious Ollama Activities,MEASURE,Measure 2.6|Measure 2.7,high,generated_rule,Prompt-behavior and harmful-content measurement signal; AI security and resilience evaluation signal
+Ollama,Ollama Server,Ollama Abnormal Network Connectivity,production,Anomaly,Suspicious Ollama Activities,MAP,Map 4.1,high,generated_rule,"AI component, model, or service discovery signal"
+Ollama,Ollama Server,Ollama Excessive API Requests,production,Anomaly,Suspicious Ollama Activities,MEASURE|MANAGE,Measure 2.4|Manage 4.1,high,generated_rule,Production behavior monitoring signal; Post-deployment monitoring and response signal
+Ollama,Ollama Server,Ollama Long-Running Inference Requests,production,Anomaly,Suspicious Ollama Activities,MEASURE,Measure 2.4,high,generated_rule,Production AI functionality and behavior monitoring signal
+Ollama,Ollama Server,Ollama Possible API Endpoint Scan Reconnaissance,production,Anomaly,Suspicious Ollama Activities,MAP,Map 4.1,high,generated_rule,"AI component, model, or service discovery signal"
+Ollama,Ollama Server,Ollama Possible Memory Exhaustion Resource Abuse,production,Anomaly,Suspicious Ollama Activities,MEASURE|MANAGE,Measure 2.4|Manage 4.1,high,generated_rule,Production behavior monitoring signal; Post-deployment monitoring and response signal
+Ollama,Ollama Server,Ollama Repeated Application Errors,production,Anomaly,Suspicious Ollama Activities,MEASURE|MANAGE,Measure 2.4|Manage 4.3,high,generated_rule,Production behavior monitoring and incident/error tracking signal

lookups/csv/detection_subcategory_map.yml

@@ -2,7 +2,7 @@ name: detection_subcategory_map
 id: 41c7e6c8-b835-4dd8-b7ed-b1f5d8476e84
 version: 3
 creation_date: '2026-09-02'
-modification_date: '2026-10-08'
+modification_date: '2026-10-13'
 author: Nasreddine Bencherchali, Rod Soto, Splunk Threat Research Team
 lookup_type: csv
 description: Generated mapping of AI-related ESCU detections to NIST AI RMF subcategory IDs for dashboard coverage reporting.

scripts/nist_dashboard/generate_nist_ai_rmf_detection_map.py

@@ -81,6 +81,16 @@ class MappingRule:
         ("Measure 2.4",),
         "Production behavior monitoring signal",
     ),
+    MappingRule(
+        re.compile(r"\blong[- ]running inference requests?\b", re.I),
+        ("Measure 2.4",),
+        "Production AI functionality and behavior monitoring signal",
+    ),
+    MappingRule(
+        re.compile(r"\brepeated (?:ollama )?application errors?\b", re.I),
+        ("Measure 2.4", "Manage 4.3"),
+        "Production behavior monitoring and incident/error tracking signal",
+    ),
     MappingRule(
         re.compile(r"\b(prompt injection|jailbreak|ignore previous|system prompt override|hostile prompt|sentiment)\b", re.I),
         ("Measure 2.6",),
@@ -383,6 +393,13 @@ def main() -> int:
     output_changed = write_csv_if_changed(csv_content, None if args.dry_run else args.output)
 
     message = f"Generated {len(rows)} detection mappings from {len(selectors)} data source selectors."
+    review_rows = [row for row in rows if row["mapping_source"] == "generated_review"]
+    if review_rows:
+        message += f" {len(review_rows)} mapping(s) need manual review:"
+        for row in review_rows:
+            message += f"\n  - {row['ai_system']}: {row['detection_name']} — {row['mapping_reason']}"
+    else:
+        message += " No mappings need manual review."
     if not args.dry_run:
         if output_changed and not args.no_metadata_update:
             new_version = bump_lookup_metadata(args.metadata, validate_modified_date(args.modified_date))