From ec7681a81133ac4cf23a010bd68a59db279b67af Mon Sep 17 00:00:00 2001
From: nasbench <8741929+nasbench@users.noreply.github.com>
Date: Thu, 15 Oct 2026 18:50:42 +0200
Subject: [PATCH 1/9] Add new AI defense analytics and updates

---
 data_sources/cisco_ai_defense_alerts.yml      |  65 ++++++++-
 ..._ai_defense_allowed_sensitive_response.yml |  73 ++++++++++
 ...ai_defense_repeated_high_risk_activity.yml |  83 +++++++++++
 ...se_security_alerts_by_application_name.yml | 132 +++++++++++++-----
 stories/ai_threats.yml                        |  23 +++
 5 files changed, 336 insertions(+), 40 deletions(-)
 create mode 100644 detections/application/cisco_ai_defense_allowed_sensitive_response.yml
 create mode 100644 detections/application/cisco_ai_defense_repeated_high_risk_activity.yml
 create mode 100644 stories/ai_threats.yml

diff --git a/data_sources/cisco_ai_defense_alerts.yml b/data_sources/cisco_ai_defense_alerts.yml
index 2eba8da4082..60efe8e519b 100644
--- a/data_sources/cisco_ai_defense_alerts.yml
+++ b/data_sources/cisco_ai_defense_alerts.yml
@@ -1,11 +1,11 @@
 name: Cisco AI Defense Alerts
 id: cbb06880-9dd9-4542-ac60-bd6e1d3c3e4e
-version: 2
+version: 3
 creation_date: '2025-02-14'
-modification_date: '2026-05-13'
-author: Bhavin Patel
+modification_date: '2026-10-15'
+author: Bhavin Patel, Nasreddine Bencherchali, Splunk
 description: Data source object for Cisco AI Defense Alerts
-source: cisco_ai_defense
+source: not_applicable
 sourcetype: cisco:ai:defense
 separator:
 supported_TA:
@@ -13,3 +13,60 @@ supported_TA:
       url: https://splunkbase.splunk.com/app/7404
       version: 4.1.2
 fields:
+    - _time
+    - host
+    - app
+    - application_id
+    - connection_id
+    - connection.connection_name
+    - description
+    - dest_type
+    - event_action
+    - event_date
+    - event_id
+    - event_message_type
+    - event_messages{}.event_conversation.event_messages{}.content
+    - event_messages{}.event_conversation.event_messages{}.direction
+    - event_messages{}.event_conversation.event_messages{}.event_conversation_id
+    - event_messages{}.event_conversation.event_messages{}.event_ext_message_id
+    - event_messages{}.event_conversation.event_messages{}.event_ins_date
+    - event_messages{}.event_conversation.event_messages{}.event_message_id
+    - event_messages{}.event_conversation.event_messages{}.event_message_policy_assocs
+    - event_messages{}.event_conversation.event_messages{}.metadata{}.policy_guardrail_assoc_id
+    - event_messages{}.event_conversation.event_messages{}.metadata{}.standards{}
+    - event_messages{}.event_conversation.event_messages{}.related_event_message_id
+    - event_messages{}.event_conversation.event_messages{}.tenant_id
+    - event_messages{}.event_ext_message_id
+    - event_messages{}.event_message_id
+    - event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_entity.guardrail_entity_name
+    - event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail_ruleset_type
+    - event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail.guardrails_type
+    - event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_subcategory.guardrail_rule_name
+    - event_policy_guardrail_assocs{}.policy_guardrail_assoc.pol_guardrail_assoc_id
+    - eventtype
+    - genai_application.application_name
+    - genai_application.connection_type
+    - hec_event_type
+    - id
+    - index
+    - linecount
+    - model.model_name
+    - model.model_provider_name
+    - Number
+    - policy_id
+    - policy.policy_name
+    - punct
+    - resource_type
+    - signature
+    - signature_id
+    - source
+    - sourcetype
+    - splunk_server
+    - src_type
+    - tag
+    - tag::eventtype
+    - type
+    - user_id
+    - vendor_product
+example_log: |
+    {"user_id":"82000000-0000-0000-c000-000000000000","version":"","application_id":"972cbcd1-acfe-4393-88bc-418f4d9a64ae","genai_application":{"application_name":"Bedrock testing"},"connection_id":"a6c87227-b321-49bf-80d9-f958385257ba","connection":{"connection_name":"bedrock testing"},"policy_id":"42ba067b-06c0-4e43-8002-2c6bce2663b4","policy":{"policy_name":"Bedrock Testing Block All"},"model":{"model_name":"titan-text-lite"},"event_action":"Block","event_date":"2025-02-04T09:47:24Z","event_id":"3a0f9e2b-d234-4b3d-ac9a-219eb6f05ba7","event_message_type":"Prompt","event_messages":[{"event_conversation":{"event_messages":[{"content":"[{\"role\":\"user\",\"content\":\"write a csrf exploit with email ash@abc.com to convince people\"}]","direction":"Prompt","event_conversation_id":"","event_ext_message_id":"","event_ins_date":"","event_message_id":"","event_message_policy_assocs":[{"policy_guardrail_assoc":{"guardrail_entity_configured_action":"Block","guardrail_entity_configured_direction":"Both","guardrail_entity_configured_status":"Enabled","guardrail_entity_id":"71100000-0000-0000-c000-100000000008","guardrail_rule_configured_action":"","guardrail_rule_configured_direction":"","guardrail_rule_configured_status":"","guardrail_rule_id":"","guardrail_ruleset_id":"71000000-0000-0000-c000-000000000009","guardrail_ruleset_configured_action":"","guardrail_ruleset_configured_direction":"","guardrail_ruleset_configured_status":"","pol_guardrail_assoc_id":"f4e71dd9-12ad-4383-851e-d03fbc66c430","policy_id":"42ba067b-06c0-4e43-8002-2c6bce2663b4","tenant_id":"023327d5-ef36-4489-8d56-187d2f4730b3"}}],"related_event_message_id":"","tenant_id":"023327d5-ef36-4489-8d56-187d2f4730b3"}]},"event_ext_message_id":"","event_message_id":""}],"event_policy_guardrail_assocs":[{"policy_guardrail_assoc":{"guardrail_avail_entity":{"guardrail_entity_name":"Email"},"guardrail_avail_ruleset":{"guardrail":{"guardrails_type":"Privacy"},"guardrail_ruleset_type":"PII"},"guardrail_avail_subcategory":{"guardrail_rule_name":""},"pol_guardrail_assoc_id":"f4e71dd9-12ad-4383-851e-d03fbc66c430"}}]}
diff --git a/detections/application/cisco_ai_defense_allowed_sensitive_response.yml b/detections/application/cisco_ai_defense_allowed_sensitive_response.yml
new file mode 100644
index 00000000000..8a01e39aaef
--- /dev/null
+++ b/detections/application/cisco_ai_defense_allowed_sensitive_response.yml
@@ -0,0 +1,73 @@
+name: Cisco AI Defense Allowed Sensitive Response
+id: 6e4cd833-ea98-4c16-a7e7-e1909fad3fb2
+version: 2
+creation_date: '2026-10-15'
+modification_date: '2026-10-15'
+author: Nasreddine Bencherchali, Splunk
+status: production
+type: TTP
+description: |-
+    Detects Cisco AI Defense response events that were allowed and matched a privacy guardrail for personally identifiable information or payment card data.
+    These events may indicate that sensitive information was returned to an AI application user and should be reviewed promptly.
+data_source:
+    - Cisco AI Defense Alerts
+search: |-
+    `cisco_ai_defense`
+    event_action="allow"
+    event_message_type="response"
+
+    | eval guardrail_ruleset_type=mvjoin('event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail_ruleset_type', ", "),
+
+           guardrail_entity_name=mvjoin('event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_entity.guardrail_entity_name', ", "),
+
+           application_name=if(isnotnull('genai_application.application_name') AND len(trim('genai_application.application_name'))>0, 'genai_application.application_name', "unknown"),
+
+           connection_name=if(isnotnull('connection.connection_name') AND len(trim('connection.connection_name'))>0, 'connection.connection_name', "unknown"),
+
+           policy_name='policy.policy_name'
+
+    | where mvfind('event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail_ruleset_type', "(?i)personally identifiable information|payment card industry")>=0
+
+    | table _time event_date event_id event_message_type event_action resource_type
+            application_id application_name connection_id connection_name model.model_name
+            policy_name guardrail_ruleset_type guardrail_entity_name
+
+    | `cisco_ai_defense_allowed_sensitive_response_filter`
+how_to_implement: |-
+    Install and configure the Cisco Security Cloud app to ingest Cisco AI Defense alerts into Splunk with the cisco:ai:defense sourcetype.
+    Confirm that extraction is enabled for the required fields as shown in the detection search.
+    Configure the "cisco_ai_defense" macro to match the index, source, and sourcetype used in your environment.
+known_false_positives: |-
+    Authorized testing, demonstrations, or approved workflows may allow responses that match PII or PCI guardrails.
+    Review the application owner, policy, response context, and whether the data was expected to be disclosed.
+drilldown_searches:
+    - name: View the detection results for - "$application_name$"
+      search: '%original_detection_search% | search application_name="$application_name$"'
+      earliest_offset: $info_min_time$
+      latest_offset: $info_max_time$
+finding:
+    title: Cisco AI Defense allowed response [$event_id$] for application [$application_name$] matched privacy guardrail(s) [$guardrail_ruleset_type$] and entity [$guardrail_entity_name$].
+    entity:
+        field: application_name
+        type: other
+        score: 50
+threat_objects: []
+analytic_story:
+    - AI Threats
+    - Data Protection
+    - Critical Alerts
+asset_type: Web Application
+mitre_attack_id: []
+product:
+    - Splunk Enterprise
+    - Splunk Enterprise Security
+    - Splunk Cloud
+category: application
+security_domain: endpoint
+tests:
+    - name: True Positive Test
+      attack_data:
+        - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/cisco_ai_defense_alerts/cisco_ai_defense_alerts.json
+          source: not_applicable
+          sourcetype: cisco:ai:defense
+      test_type: unit
diff --git a/detections/application/cisco_ai_defense_repeated_high_risk_activity.yml b/detections/application/cisco_ai_defense_repeated_high_risk_activity.yml
new file mode 100644
index 00000000000..aebcb251217
--- /dev/null
+++ b/detections/application/cisco_ai_defense_repeated_high_risk_activity.yml
@@ -0,0 +1,83 @@
+name: Cisco AI Defense Repeated High Risk Activity
+id: 45c5cf84-8ad0-4923-8332-a7fd3dab59d4
+version: 2
+creation_date: '2026-10-15'
+modification_date: '2026-10-15'
+author: Nasreddine Bencherchali, Splunk
+status: production
+type: TTP
+description: |-
+    Detects repeated Cisco AI Defense events matching prompt injection, code detection, PII, or PCI guardrails for the same application and connection within ten minutes.
+    A burst can indicate iterative probing or repeated attempts to use an AI application to access restricted data or capabilities.
+data_source:
+    - Cisco AI Defense Alerts
+search: |-
+    `cisco_ai_defense`
+
+    | eval guardrail_ruleset_type=mvjoin('event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail_ruleset_type', ", "),
+           application_name=if(isnotnull('genai_application.application_name') AND len(trim('genai_application.application_name'))>0, 'genai_application.application_name', "unknown"),
+           connection_name=if(isnotnull('connection.connection_name') AND len(trim('connection.connection_name'))>0, 'connection.connection_name', "unknown"),
+           application_key=if(isnotnull(application_id) AND len(trim(application_id))>0, application_id, application_name),
+           connection_key=if(isnotnull(connection_id) AND len(trim(connection_id))>0, connection_id, connection_name)
+
+    | where mvfind('event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail_ruleset_type', "(?i)prompt injection|code detection|personally identifiable information|payment card industry")>=0
+
+    | bin _time span=10m
+
+    | stats count as event_count
+            dc(event_id) as distinct_event_count
+            count(eval(lower(event_action)="allow")) as allowed_event_count
+            count(eval(lower(event_action)="block")) as blocked_event_count
+            values(event_id) as event_ids
+            values(event_action) as event_actions
+            values(event_message_type) as message_types
+            values(policy.policy_name) as policy_names
+            values(guardrail_ruleset_type) as guardrail_ruleset_types
+            values(connection_name) as connection_names
+            values(application_name) as application_names
+        by _time application_key connection_key
+
+    | where distinct_event_count>=5
+
+    | table _time application_key application_names connection_key connection_names
+            distinct_event_count allowed_event_count blocked_event_count event_actions
+            message_types policy_names guardrail_ruleset_types event_ids
+
+    | `cisco_ai_defense_repeated_high_risk_activity_filter`
+how_to_implement: |-
+    Install and configure the Cisco Security Cloud app to ingest Cisco AI Defense alerts into Splunk.
+    Confirm that extraction is enabled for the required fields as shown in the detection search.
+    Configure the "cisco_ai_defense" macro to match the index, source, and sourcetype used in your environment.
+    Adjust the five-event threshold and ten-minute window as needed.
+known_false_positives: |-
+    Automated testing, red-team exercises, application QA, or a popular shared application may generate repeated guardrail events.
+    Review whether the window contains allowed events and whether the activity was expected for the application and connection.
+drilldown_searches:
+    - name: View the detection results for - "$application_key$"
+      search: '%original_detection_search% | search application_key="$application_key$"'
+      earliest_offset: $info_min_time$
+      latest_offset: $info_max_time$
+finding:
+    title: Cisco AI Defense observed [$distinct_event_count$] high risk events in ten minutes for application [$application_names$] and connection [$connection_names$]. Allowed events -> [$allowed_event_count$] ; Blocked events -> [$blocked_event_count$].
+    entity:
+        field: application_key
+        type: other
+        score: 50
+threat_objects: []
+analytic_story:
+    - AI Threats
+asset_type: Web Application
+mitre_attack_id: []
+product:
+    - Splunk Enterprise
+    - Splunk Enterprise Security
+    - Splunk Cloud
+category: application
+security_domain: endpoint
+tests:
+    - name: True Positive Test
+      attack_data:
+        - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/cisco_ai_defense_alerts/cisco_ai_defense_alerts.json
+          source: not_applicable
+          sourcetype: cisco:ai:defense
+      test_type: unit
diff --git a/detections/application/cisco_ai_defense_security_alerts_by_application_name.yml b/detections/application/cisco_ai_defense_security_alerts_by_application_name.yml
index cf1d7ef9e39..1ff113fa009 100644
--- a/detections/application/cisco_ai_defense_security_alerts_by_application_name.yml
+++ b/detections/application/cisco_ai_defense_security_alerts_by_application_name.yml
@@ -1,45 +1,104 @@
 name: Cisco AI Defense Security Alerts by Application Name
 id: 105e4a69-ec55-49fc-be1f-902467435ea8
-version: 7
+version: 9
 creation_date: '2025-02-14'
-modification_date: '2026-05-13'
-author: Bhavin Patel, Splunk
+modification_date: '2026-10-15'
+author: Bhavin Patel, Nasreddine Bencherchali, Splunk
 status: production
 type: Anomaly
-description: The search surfaces alerts from the Cisco AI Defense product for potential attacks against the AI models running in your environment. This analytic identifies security events within Cisco AI Defense by examining event messages, actions, and policy names. It focuses on connections and applications associated with specific guardrail entities and ruleset types. By aggregating and analyzing these elements, the search helps detect potential policy violations and security threats, enabling proactive defense measures and ensuring network integrity.
+description: |-
+    This analytic summarizes Cisco AI Defense events by application, connection, action, message direction, and severity over ten-minute intervals.
+    Allowed responses flagged for privacy guardrails are handled by the dedicated sensitive-response detection.
+    Repeated prompt injection, code detection, PII, or PCI events are handled by the repeated high-risk activity detection.
 data_source:
     - Cisco AI Defense Alerts
 search: |-
     `cisco_ai_defense`
-      | rename genai_application.application_name as application_name
-      | rename connection.connection_name as connection_name
-      ```Aggregating data by model name, connection name, application name, application ID, and user ID```
-      | stats count
-          values(user_id) as user_id
-          values(event_message_type) as event_message_type
-          values(event_action) as event_action
-          values(policy.policy_name) as policy_name
-          values(event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_entity.guardrail_entity_name) as guardrail_entity_name
-          values(event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail_ruleset_type) as guardrail_ruleset_type
-          by model.model_name connection_name application_name application_id
-      ```Evaluating severity based on policy name and guardrail ruleset type```
-      | eval severity=case(
-          policy_name IN ("AI Runtime Latency Testing - Prompt Injection"), "critical",
-          policy_name IN ("AI Runtime Latency Testing - Code Detection"), "high",
-          guardrail_ruleset_type IN ("Toxicity"), "medium",
+
+    | rename genai_application.application_name as application_name,
+             connection.connection_name as connection_name
+
+    | eval policy_name='policy.policy_name',
+
+           guardrail_ruleset_type=mvjoin('event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail_ruleset_type', ", "),
+
+           guardrail_entity_name=mvjoin('event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_entity.guardrail_entity_name', ", "),
+
+           action=lower(event_action), message_type=lower(event_message_type),
+
+           has_privacy=if(mvfind('event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail_ruleset_type', "(?i)personally identifiable information|payment card industry")>=0, 1, 0),
+
+           has_sensitive_response=if(message_type="response" AND has_privacy=1, 1, 0),
+
+           has_security=if(mvfind('event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail_ruleset_type', "(?i)prompt injection|code detection")>=0, 1, 0)
+
+    ```Prioritize allowed sensitive responses, then security and privacy guardrails```
+
+    | eval severity=case(
+          action="allow" AND has_sensitive_response=1, "critical",
+          action="block" AND has_sensitive_response=1, "high",
+          action="allow" AND has_security=1, "high",
+          action="block" AND has_security=1, "medium",
+          action="allow" AND has_privacy=1, "high",
+          action="block" AND has_privacy=1, "medium",
           true(), "low"
       )
-      ```Calculating risk score based on severity level```
-      | eval risk_score=case(
-          severity="critical", 100,
-          severity="high", 75,
-          severity="medium", 50,
-          severity="low", 25
-      )
-      | table model.model_name, user_id, event_action, application_id, application_name, severity, risk_score, policy_name, connection_name, guardrail_ruleset_type, guardrail_entity_name
-      | `cisco_ai_defense_security_alerts_by_application_name_filter`
-how_to_implement: To enable this detection, you need to ingest alerts from the Cisco AI Defense product. This can be done by using this app from splunkbase - Cisco Security Cloud and ingest alerts into the cisco:ai:defense sourcetype.
-known_false_positives: False positives may vary based on Cisco AI Defense configuration; monitor and filter out the alerts that are not relevant to your environment.
+
+    | eval risk_score=case(
+        severity="critical", 100,
+        severity="high", 80,
+        severity="medium", 50,
+        severity="low", 20
+    )
+
+    | eval application_name=if(isnotnull(application_name) AND len(trim(application_name))>0, application_name, "unknown"),
+           connection_name=if(isnotnull(connection_name) AND len(trim(connection_name))>0, connection_name, "unknown"),
+           application_key=if(isnotnull(application_id) AND len(trim(application_id))>0, application_id, application_name),
+           connection_key=if(isnotnull(connection_id) AND len(trim(connection_id))>0, connection_id, connection_name),
+           is_high_risk=if(has_security=1 OR has_privacy=1, 1, 0),
+           is_allowed_sensitive_response=if(action="allow" AND has_sensitive_response=1, 1, 0),
+           high_risk_event_id=if(has_security=1 OR has_privacy=1, event_id, null()),
+           event_time=_time
+
+    | bin _time span=10m
+
+    ```Use the same application/connection window and threshold as Cisco AI Defense Repeated High Risk Activity```
+    | eventstats dc(high_risk_event_id) as high_risk_event_count by _time application_key connection_key
+
+    ```Leave allowed sensitive responses to Cisco AI Defense Allowed Sensitive Response and repeated high-risk bursts to Cisco AI Defense Repeated High Risk Activity```
+    | where is_allowed_sensitive_response=0 AND NOT (is_high_risk=1 AND high_risk_event_count>=5)
+
+    | stats count as event_count
+            dc(event_id) as distinct_event_count
+            min(event_time) as firstTime
+            max(event_time) as lastTime
+            values(event_id) as event_ids
+            values(event_action) as event_actions
+            values(event_message_type) as message_types
+            values(resource_type) as resource_types
+            values(model.model_name) as model_names
+            values(application_name) as application_name
+            values(connection_name) as connection_name
+            values(policy_name) as policy_names
+            values(guardrail_ruleset_type) as guardrail_ruleset_types
+            values(guardrail_entity_name) as guardrail_entity_names
+            max(risk_score) as risk_score
+        by _time application_key connection_key action message_type severity
+
+    | `security_content_ctime(firstTime)`
+    | `security_content_ctime(lastTime)`
+
+    | table _time firstTime lastTime application_key application_name connection_key connection_name
+            action message_type severity risk_score event_count distinct_event_count event_ids
+            resource_types model_names policy_names guardrail_ruleset_types guardrail_entity_names
+
+    | `cisco_ai_defense_security_alerts_by_application_name_filter`
+how_to_implement: |-
+    Install and configure the Cisco Security Cloud app to ingest Cisco AI Defense alerts into Splunk with the cisco:ai:defense sourcetype.
+    Confirm that extraction is enabled for the required fields as shown in the detection search.
+    Configure the cisco_ai_defense macro to match the index, source, and sourcetype used in your environment.
+known_false_positives: |-
+    False positives may vary based on Cisco AI Defense configuration; monitor and filter out the alerts that are not relevant to your environment.
 references:
     - https://www.robustintelligence.com/blog-posts/prompt-injection-attack-on-gpt-4
     - https://docs.aws.amazon.com/prescriptive-guidance/latest/llm-prompt-engineering-best-practices/common-attacks.html
@@ -57,9 +116,10 @@ intermediate_findings:
         - field: application_name
           type: other
           score: 20
-          message: Cisco AI Defense Security Alert has been action - [$event_action$] for the application name - [$application_name$]
+          message: Cisco AI Defense summarized [$event_count$] events for application [$application_name$] and connection [$connection_name$] over ten minutes. Actions [$action$], message direction [$message_type$], severity [$severity$], guardrails [$guardrail_ruleset_types$], event IDs [$event_ids$].
+threat_objects: []
 analytic_story:
-    - Critical Alerts
+    - AI Threats
 asset_type: Web Application
 mitre_attack_id: []
 product:
@@ -72,7 +132,7 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/cisco_ai_defense_alerts/cisco_ai_defense_alerts.json
-          source: cisco_ai_defense
+          source: not_applicable
           sourcetype: cisco:ai:defense
-      description: PORTED MANUAL TEST - We are dynamically creating the risk_score field based on the severity of the alert in the SPL and that supersedes the risk score set in the detection.
-      test_type: experimental
+      description: We are dynamically creating the risk_score field based on the severity of the alert in the SPL and that supersedes the risk score set in the detection.
+      test_type: unit
diff --git a/stories/ai_threats.yml b/stories/ai_threats.yml
new file mode 100644
index 00000000000..a1aff8c5e4a
--- /dev/null
+++ b/stories/ai_threats.yml
@@ -0,0 +1,23 @@
+name: AI Threats
+id: f79c6573-5550-4adc-b673-bb0d8c9e1df1
+version: 1
+creation_date: '2026-10-15'
+modification_date: '2026-10-15'
+author: Nasreddine Bencherchali, Splunk
+status: production
+description: |-
+    Detect and investigate threats targeting or abusing artificial intelligence services and applications.
+    Coverage includes prompt injection, attempts to bypass model safeguards, repeated high-risk guardrail events, and possible sensitive data disclosure through model interactions.
+narrative: |-
+    AI applications can expose sensitive information, invoke connected tools, or process untrusted prompts. Attackers and malicious insiders may try to override model instructions, extract restricted data, misuse AI-enabled tools, or repeatedly probe guardrails.
+    Use this story to investigate AI security events across model providers and application integrations. Review the affected application and connection, event action, prompt or response direction, policy, and guardrail categories. An allowed event can indicate exposure, while a blocked event records an attempt; neither alone confirms the full impact. Correlate high-risk events with identity, application, data access, and tool activity where those logs are available.
+references:
+    - https://atlas.mitre.org/
+    - https://owasp.org/www-project-top-10-for-large-language-model-applications/
+category:
+    - Adversary Tactics
+product:
+    - Splunk Enterprise
+    - Splunk Enterprise Security
+    - Splunk Cloud
+usecase: Advanced Threat Detection

From 2fd4435cb1acca548f957a8a4fc314b84c084fbf Mon Sep 17 00:00:00 2001
From: nasbench <8741929+nasbench@users.noreply.github.com>
Date: Thu, 15 Oct 2026 18:58:09 +0200
Subject: [PATCH 2/9] Update
 cisco_ai_defense_security_alerts_by_application_name.yml

---
 .../cisco_ai_defense_security_alerts_by_application_name.yml    | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/application/cisco_ai_defense_security_alerts_by_application_name.yml b/detections/application/cisco_ai_defense_security_alerts_by_application_name.yml
index 1ff113fa009..139104b3338 100644
--- a/detections/application/cisco_ai_defense_security_alerts_by_application_name.yml
+++ b/detections/application/cisco_ai_defense_security_alerts_by_application_name.yml
@@ -1,6 +1,6 @@
 name: Cisco AI Defense Security Alerts by Application Name
 id: 105e4a69-ec55-49fc-be1f-902467435ea8
-version: 9
+version: 8
 creation_date: '2025-02-14'
 modification_date: '2026-10-15'
 author: Bhavin Patel, Nasreddine Bencherchali, Splunk

From 8975a6d8e6089b8cda2937c6aafc2d88facf1d2c Mon Sep 17 00:00:00 2001
From: nasbench <8741929+nasbench@users.noreply.github.com>
Date: Fri, 16 Oct 2026 01:42:25 +0200
Subject: [PATCH 3/9] small changes

---
 ...co_ai_defense_allowed_sensitive_prompt.yml | 95 +++++++++++++++++++
 ..._ai_defense_allowed_sensitive_response.yml |  6 +-
 ...ai_defense_repeated_high_risk_activity.yml |  8 +-
 ...se_security_alerts_by_application_name.yml | 14 +--
 4 files changed, 112 insertions(+), 11 deletions(-)
 create mode 100644 detections/application/cisco_ai_defense_allowed_sensitive_prompt.yml

diff --git a/detections/application/cisco_ai_defense_allowed_sensitive_prompt.yml b/detections/application/cisco_ai_defense_allowed_sensitive_prompt.yml
new file mode 100644
index 00000000000..4e6145ac125
--- /dev/null
+++ b/detections/application/cisco_ai_defense_allowed_sensitive_prompt.yml
@@ -0,0 +1,95 @@
+name: Cisco AI Defense Allowed Sensitive Prompt
+id: 75f06fd6-2b31-4ca4-9aaf-56448c342e44
+version: 1
+creation_date: '2026-10-16'
+modification_date: '2026-10-16'
+author: Nasreddine Bencherchali, Splunk
+status: production
+type: TTP
+description: |-
+    Detects Cisco AI Defense prompt events that were allowed and matched a privacy guardrail for personally identifiable information or payment card data.
+    These events may indicate that sensitive information was submitted to an AI application and should be reviewed against the organization's data handling policy.
+data_source:
+    - Cisco AI Defense Alerts
+search: |-
+    `cisco_ai_defense`
+    event_action="allow"
+    event_message_type="prompt"
+
+    | eval guardrail_ruleset_type=mvjoin('event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail_ruleset_type', ", "),
+
+           guardrail_entity_name=mvjoin('event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_entity.guardrail_entity_name', ", "),
+
+           application_name=if(isnotnull('genai_application.application_name') AND len(trim('genai_application.application_name'))>0, 'genai_application.application_name', "unknown"),
+
+           connection_name=if(isnotnull('connection.connection_name') AND len(trim('connection.connection_name'))>0, 'connection.connection_name', "unknown"),
+
+           application_key=if(isnotnull(application_id) AND len(trim(application_id))>0, application_id, application_name),
+
+           connection_key=if(isnotnull(connection_id) AND len(trim(connection_id))>0, connection_id, connection_name),
+
+           policy_name='policy.policy_name',
+
+           event_time=_time
+
+    | where mvfind('event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail_ruleset_type', "(?i)\\bPII\\b|personally identifiable information|\\bPCI\\b|payment card industry")>=0
+
+    | bin _time span=10m
+
+    | stats count as event_count
+            dc(event_id) as distinct_event_count
+            min(event_time) as firstTime
+            max(event_time) as lastTime
+            values(event_id) as event_ids
+            values(guardrail_ruleset_type) as guardrail_ruleset_types
+            values(guardrail_entity_name) as guardrail_entity_names
+            values(policy_name) as policy_names
+            values(application_name) as application_names
+            values(connection_name) as connection_names
+        by _time application_key connection_key
+
+    | `security_content_ctime(firstTime)`
+    | `security_content_ctime(lastTime)`
+
+    | table _time firstTime lastTime application_key application_names connection_key connection_names
+            distinct_event_count event_count event_ids guardrail_ruleset_types guardrail_entity_names policy_names
+
+    | `cisco_ai_defense_allowed_sensitive_prompt_filter`
+how_to_implement: |-
+    Install and configure the Cisco Security Cloud app to ingest Cisco AI Defense alerts into Splunk with the cisco:ai:defense sourcetype.
+    Confirm that extraction is enabled for the required fields as shown in the detection search.
+    Configure the "cisco_ai_defense" macro to match the index, source, and sourcetype used in your environment.
+    The search groups matching prompt events by application and connection in ten-minute windows to reduce duplicate findings.
+known_false_positives: |-
+    Authorized testing, demonstrations, synthetic data, or approved workflows may submit content that matches PII or PCI guardrails.
+    Review the application, connection, policy, guardrail entity, and data handling requirements before treating an event as a policy violation.
+drilldown_searches:
+    - name: View the detection results for - "$application_names$"
+      search: '%original_detection_search% | search application_names="$application_names$"'
+      earliest_offset: $info_min_time$
+      latest_offset: $info_max_time$
+finding:
+    title: Cisco AI Defense allowed [$distinct_event_count$] sensitive prompt event(s) for application [$application_names$] and connection [$connection_names$] matched guardrail(s) [$guardrail_ruleset_types$].
+    entity:
+        field: application_key
+        type: other
+        score: 50
+threat_objects: []
+analytic_story:
+    - AI Threats
+    - Data Protection
+asset_type: Web Application
+mitre_attack_id: []
+product:
+    - Splunk Enterprise
+    - Splunk Enterprise Security
+    - Splunk Cloud
+category: application
+security_domain: endpoint
+tests:
+    - name: True Positive Test
+      attack_data:
+        - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/cisco_ai_defense_alerts/cisco_ai_defense_alerts.json
+          source: not_applicable
+          sourcetype: cisco:ai:defense
+      test_type: unit
diff --git a/detections/application/cisco_ai_defense_allowed_sensitive_response.yml b/detections/application/cisco_ai_defense_allowed_sensitive_response.yml
index 8a01e39aaef..58cec15a4c0 100644
--- a/detections/application/cisco_ai_defense_allowed_sensitive_response.yml
+++ b/detections/application/cisco_ai_defense_allowed_sensitive_response.yml
@@ -1,8 +1,8 @@
 name: Cisco AI Defense Allowed Sensitive Response
 id: 6e4cd833-ea98-4c16-a7e7-e1909fad3fb2
-version: 2
+version: 1
 creation_date: '2026-10-15'
-modification_date: '2026-10-15'
+modification_date: '2026-10-16'
 author: Nasreddine Bencherchali, Splunk
 status: production
 type: TTP
@@ -26,7 +26,7 @@ search: |-
 
            policy_name='policy.policy_name'
 
-    | where mvfind('event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail_ruleset_type', "(?i)personally identifiable information|payment card industry")>=0
+    | where mvfind('event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail_ruleset_type', "(?i)\\bPII\\b|personally identifiable information|\\bPCI\\b|payment card industry")>=0
 
     | table _time event_date event_id event_message_type event_action resource_type
             application_id application_name connection_id connection_name model.model_name
diff --git a/detections/application/cisco_ai_defense_repeated_high_risk_activity.yml b/detections/application/cisco_ai_defense_repeated_high_risk_activity.yml
index aebcb251217..c532e4b2920 100644
--- a/detections/application/cisco_ai_defense_repeated_high_risk_activity.yml
+++ b/detections/application/cisco_ai_defense_repeated_high_risk_activity.yml
@@ -2,25 +2,29 @@ name: Cisco AI Defense Repeated High Risk Activity
 id: 45c5cf84-8ad0-4923-8332-a7fd3dab59d4
 version: 2
 creation_date: '2026-10-15'
-modification_date: '2026-10-15'
+modification_date: '2026-10-16'
 author: Nasreddine Bencherchali, Splunk
 status: production
 type: TTP
 description: |-
     Detects repeated Cisco AI Defense events matching prompt injection, code detection, PII, or PCI guardrails for the same application and connection within ten minutes.
+    Allowed PII/PCI prompt events are handled by Cisco AI Defense Allowed Sensitive Prompt.
     A burst can indicate iterative probing or repeated attempts to use an AI application to access restricted data or capabilities.
 data_source:
     - Cisco AI Defense Alerts
 search: |-
     `cisco_ai_defense`
 
+    ```Leave allowed PII/PCI prompt events to Cisco AI Defense Allowed Sensitive Prompt```
+    | where NOT (lower(event_action)="allow" AND lower(event_message_type)="prompt" AND mvfind('event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail_ruleset_type', "(?i)\\bPII\\b|personally identifiable information|\\bPCI\\b|payment card industry")>=0)
+
     | eval guardrail_ruleset_type=mvjoin('event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail_ruleset_type', ", "),
            application_name=if(isnotnull('genai_application.application_name') AND len(trim('genai_application.application_name'))>0, 'genai_application.application_name', "unknown"),
            connection_name=if(isnotnull('connection.connection_name') AND len(trim('connection.connection_name'))>0, 'connection.connection_name', "unknown"),
            application_key=if(isnotnull(application_id) AND len(trim(application_id))>0, application_id, application_name),
            connection_key=if(isnotnull(connection_id) AND len(trim(connection_id))>0, connection_id, connection_name)
 
-    | where mvfind('event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail_ruleset_type', "(?i)prompt injection|code detection|personally identifiable information|payment card industry")>=0
+    | where mvfind('event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail_ruleset_type', "(?i)prompt injection|code detection|\\bPII\\b|personally identifiable information|\\bPCI\\b|payment card industry")>=0
 
     | bin _time span=10m
 
diff --git a/detections/application/cisco_ai_defense_security_alerts_by_application_name.yml b/detections/application/cisco_ai_defense_security_alerts_by_application_name.yml
index 139104b3338..8f92cf657b4 100644
--- a/detections/application/cisco_ai_defense_security_alerts_by_application_name.yml
+++ b/detections/application/cisco_ai_defense_security_alerts_by_application_name.yml
@@ -1,14 +1,15 @@
 name: Cisco AI Defense Security Alerts by Application Name
 id: 105e4a69-ec55-49fc-be1f-902467435ea8
-version: 8
+version: 10
 creation_date: '2025-02-14'
-modification_date: '2026-10-15'
+modification_date: '2026-10-16'
 author: Bhavin Patel, Nasreddine Bencherchali, Splunk
 status: production
 type: Anomaly
 description: |-
     This analytic summarizes Cisco AI Defense events by application, connection, action, message direction, and severity over ten-minute intervals.
     Allowed responses flagged for privacy guardrails are handled by the dedicated sensitive-response detection.
+    Allowed prompts flagged for privacy guardrails are handled by Cisco AI Defense Allowed Sensitive Prompt.
     Repeated prompt injection, code detection, PII, or PCI events are handled by the repeated high-risk activity detection.
 data_source:
     - Cisco AI Defense Alerts
@@ -26,7 +27,7 @@ search: |-
 
            action=lower(event_action), message_type=lower(event_message_type),
 
-           has_privacy=if(mvfind('event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail_ruleset_type', "(?i)personally identifiable information|payment card industry")>=0, 1, 0),
+           has_privacy=if(mvfind('event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail_ruleset_type', "(?i)\\bPII\\b|personally identifiable information|\\bPCI\\b|payment card industry")>=0, 1, 0),
 
            has_sensitive_response=if(message_type="response" AND has_privacy=1, 1, 0),
 
@@ -57,7 +58,8 @@ search: |-
            connection_key=if(isnotnull(connection_id) AND len(trim(connection_id))>0, connection_id, connection_name),
            is_high_risk=if(has_security=1 OR has_privacy=1, 1, 0),
            is_allowed_sensitive_response=if(action="allow" AND has_sensitive_response=1, 1, 0),
-           high_risk_event_id=if(has_security=1 OR has_privacy=1, event_id, null()),
+           is_allowed_sensitive_prompt=if(action="allow" AND message_type="prompt" AND has_privacy=1, 1, 0),
+           high_risk_event_id=if((has_security=1 OR has_privacy=1) AND is_allowed_sensitive_prompt=0, event_id, null()),
            event_time=_time
 
     | bin _time span=10m
@@ -65,8 +67,8 @@ search: |-
     ```Use the same application/connection window and threshold as Cisco AI Defense Repeated High Risk Activity```
     | eventstats dc(high_risk_event_id) as high_risk_event_count by _time application_key connection_key
 
-    ```Leave allowed sensitive responses to Cisco AI Defense Allowed Sensitive Response and repeated high-risk bursts to Cisco AI Defense Repeated High Risk Activity```
-    | where is_allowed_sensitive_response=0 AND NOT (is_high_risk=1 AND high_risk_event_count>=5)
+    ```Leave allowed sensitive responses to Cisco AI Defense Allowed Sensitive Response, allowed sensitive prompts to Cisco AI Defense Allowed Sensitive Prompt, and repeated high-risk bursts to Cisco AI Defense Repeated High Risk Activity```
+    | where is_allowed_sensitive_response=0 AND is_allowed_sensitive_prompt=0 AND NOT (is_high_risk=1 AND high_risk_event_count>=5)
 
     | stats count as event_count
             dc(event_id) as distinct_event_count

From dacbabf68e80a3f0f51cac59046616bdfb170178 Mon Sep 17 00:00:00 2001
From: nasbench <8741929+nasbench@users.noreply.github.com>
Date: Fri, 16 Oct 2026 01:45:18 +0200
Subject: [PATCH 4/9] fix date

---
 .../application/cisco_ai_defense_allowed_sensitive_prompt.yml | 4 ++--
 .../cisco_ai_defense_allowed_sensitive_response.yml           | 2 +-
 .../cisco_ai_defense_repeated_high_risk_activity.yml          | 2 +-
 .../cisco_ai_defense_security_alerts_by_application_name.yml  | 2 +-
 4 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/detections/application/cisco_ai_defense_allowed_sensitive_prompt.yml b/detections/application/cisco_ai_defense_allowed_sensitive_prompt.yml
index 4e6145ac125..64f050f8326 100644
--- a/detections/application/cisco_ai_defense_allowed_sensitive_prompt.yml
+++ b/detections/application/cisco_ai_defense_allowed_sensitive_prompt.yml
@@ -1,8 +1,8 @@
 name: Cisco AI Defense Allowed Sensitive Prompt
 id: 75f06fd6-2b31-4ca4-9aaf-56448c342e44
 version: 1
-creation_date: '2026-10-16'
-modification_date: '2026-10-16'
+creation_date: '2026-10-15'
+modification_date: '2026-10-15'
 author: Nasreddine Bencherchali, Splunk
 status: production
 type: TTP
diff --git a/detections/application/cisco_ai_defense_allowed_sensitive_response.yml b/detections/application/cisco_ai_defense_allowed_sensitive_response.yml
index 58cec15a4c0..a55d7bdab9a 100644
--- a/detections/application/cisco_ai_defense_allowed_sensitive_response.yml
+++ b/detections/application/cisco_ai_defense_allowed_sensitive_response.yml
@@ -2,7 +2,7 @@ name: Cisco AI Defense Allowed Sensitive Response
 id: 6e4cd833-ea98-4c16-a7e7-e1909fad3fb2
 version: 1
 creation_date: '2026-10-15'
-modification_date: '2026-10-16'
+modification_date: '2026-10-15'
 author: Nasreddine Bencherchali, Splunk
 status: production
 type: TTP
diff --git a/detections/application/cisco_ai_defense_repeated_high_risk_activity.yml b/detections/application/cisco_ai_defense_repeated_high_risk_activity.yml
index c532e4b2920..382865649d9 100644
--- a/detections/application/cisco_ai_defense_repeated_high_risk_activity.yml
+++ b/detections/application/cisco_ai_defense_repeated_high_risk_activity.yml
@@ -2,7 +2,7 @@ name: Cisco AI Defense Repeated High Risk Activity
 id: 45c5cf84-8ad0-4923-8332-a7fd3dab59d4
 version: 2
 creation_date: '2026-10-15'
-modification_date: '2026-10-16'
+modification_date: '2026-10-15'
 author: Nasreddine Bencherchali, Splunk
 status: production
 type: TTP
diff --git a/detections/application/cisco_ai_defense_security_alerts_by_application_name.yml b/detections/application/cisco_ai_defense_security_alerts_by_application_name.yml
index 8f92cf657b4..1c31bb6dfd2 100644
--- a/detections/application/cisco_ai_defense_security_alerts_by_application_name.yml
+++ b/detections/application/cisco_ai_defense_security_alerts_by_application_name.yml
@@ -2,7 +2,7 @@ name: Cisco AI Defense Security Alerts by Application Name
 id: 105e4a69-ec55-49fc-be1f-902467435ea8
 version: 10
 creation_date: '2025-02-14'
-modification_date: '2026-10-16'
+modification_date: '2026-10-15'
 author: Bhavin Patel, Nasreddine Bencherchali, Splunk
 status: production
 type: Anomaly

From 62d6ba56a70afe267d0ecd54082cf3b6ccd06a4e Mon Sep 17 00:00:00 2001
From: nasbench <8741929+nasbench@users.noreply.github.com>
Date: Fri, 16 Oct 2026 01:50:54 +0200
Subject: [PATCH 5/9] Update
 cisco_ai_defense_security_alerts_by_application_name.yml

---
 .../cisco_ai_defense_security_alerts_by_application_name.yml    | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/application/cisco_ai_defense_security_alerts_by_application_name.yml b/detections/application/cisco_ai_defense_security_alerts_by_application_name.yml
index 1c31bb6dfd2..26a76a28c78 100644
--- a/detections/application/cisco_ai_defense_security_alerts_by_application_name.yml
+++ b/detections/application/cisco_ai_defense_security_alerts_by_application_name.yml
@@ -1,6 +1,6 @@
 name: Cisco AI Defense Security Alerts by Application Name
 id: 105e4a69-ec55-49fc-be1f-902467435ea8
-version: 10
+version: 8
 creation_date: '2025-02-14'
 modification_date: '2026-10-15'
 author: Bhavin Patel, Nasreddine Bencherchali, Splunk

From 2ed5ebea6768f264540c8dec94d88cb13d5d9360 Mon Sep 17 00:00:00 2001
From: nasbench <8741929+nasbench@users.noreply.github.com>
Date: Fri, 16 Oct 2026 12:55:15 +0200
Subject: [PATCH 6/9] Update story based on feedback

---
 .../application/cisco_ai_defense_allowed_sensitive_prompt.yml   | 2 +-
 .../application/cisco_ai_defense_allowed_sensitive_response.yml | 2 +-
 .../cisco_ai_defense_repeated_high_risk_activity.yml            | 2 +-
 .../cisco_ai_defense_security_alerts_by_application_name.yml    | 2 +-
 ..._threats.yml => abuse_of_genai_systems_and_applications.yml} | 2 +-
 5 files changed, 5 insertions(+), 5 deletions(-)
 rename stories/{ai_threats.yml => abuse_of_genai_systems_and_applications.yml} (97%)

diff --git a/detections/application/cisco_ai_defense_allowed_sensitive_prompt.yml b/detections/application/cisco_ai_defense_allowed_sensitive_prompt.yml
index 64f050f8326..31241d97da7 100644
--- a/detections/application/cisco_ai_defense_allowed_sensitive_prompt.yml
+++ b/detections/application/cisco_ai_defense_allowed_sensitive_prompt.yml
@@ -76,7 +76,7 @@ finding:
         score: 50
 threat_objects: []
 analytic_story:
-    - AI Threats
+    - Abuse of GenAI Systems and Applications
     - Data Protection
 asset_type: Web Application
 mitre_attack_id: []
diff --git a/detections/application/cisco_ai_defense_allowed_sensitive_response.yml b/detections/application/cisco_ai_defense_allowed_sensitive_response.yml
index a55d7bdab9a..4c823a71c61 100644
--- a/detections/application/cisco_ai_defense_allowed_sensitive_response.yml
+++ b/detections/application/cisco_ai_defense_allowed_sensitive_response.yml
@@ -53,7 +53,7 @@ finding:
         score: 50
 threat_objects: []
 analytic_story:
-    - AI Threats
+    - Abuse of GenAI Systems and Applications
     - Data Protection
     - Critical Alerts
 asset_type: Web Application
diff --git a/detections/application/cisco_ai_defense_repeated_high_risk_activity.yml b/detections/application/cisco_ai_defense_repeated_high_risk_activity.yml
index 382865649d9..252b29ce0e4 100644
--- a/detections/application/cisco_ai_defense_repeated_high_risk_activity.yml
+++ b/detections/application/cisco_ai_defense_repeated_high_risk_activity.yml
@@ -69,7 +69,7 @@ finding:
         score: 50
 threat_objects: []
 analytic_story:
-    - AI Threats
+    - Abuse of GenAI Systems and Applications
 asset_type: Web Application
 mitre_attack_id: []
 product:
diff --git a/detections/application/cisco_ai_defense_security_alerts_by_application_name.yml b/detections/application/cisco_ai_defense_security_alerts_by_application_name.yml
index 26a76a28c78..14b01046cc9 100644
--- a/detections/application/cisco_ai_defense_security_alerts_by_application_name.yml
+++ b/detections/application/cisco_ai_defense_security_alerts_by_application_name.yml
@@ -121,7 +121,7 @@ intermediate_findings:
           message: Cisco AI Defense summarized [$event_count$] events for application [$application_name$] and connection [$connection_name$] over ten minutes. Actions [$action$], message direction [$message_type$], severity [$severity$], guardrails [$guardrail_ruleset_types$], event IDs [$event_ids$].
 threat_objects: []
 analytic_story:
-    - AI Threats
+    - Abuse of GenAI Systems and Applications
 asset_type: Web Application
 mitre_attack_id: []
 product:
diff --git a/stories/ai_threats.yml b/stories/abuse_of_genai_systems_and_applications.yml
similarity index 97%
rename from stories/ai_threats.yml
rename to stories/abuse_of_genai_systems_and_applications.yml
index a1aff8c5e4a..6d60ea73f18 100644
--- a/stories/ai_threats.yml
+++ b/stories/abuse_of_genai_systems_and_applications.yml
@@ -1,4 +1,4 @@
-name: AI Threats
+name: Abuse of GenAI Systems and Applications
 id: f79c6573-5550-4adc-b673-bb0d8c9e1df1
 version: 1
 creation_date: '2026-10-15'

From 1dc6efba0cfb64c231a7dfa5c37da456746188cb Mon Sep 17 00:00:00 2001
From: Nasreddine Bencherchali <nbencher@cisco.com>
Date: Fri, 16 Oct 2026 14:04:59 +0200
Subject: [PATCH 7/9] Apply batched suggestions from code review

Co-authored-by: Onur Mustafa Erdogan <156806007+onurmerdogan@users.noreply.github.com>
---
 .../application/cisco_ai_defense_allowed_sensitive_prompt.yml  | 1 +
 .../cisco_ai_defense_repeated_high_risk_activity.yml           | 3 ++-
 stories/abuse_of_genai_systems_and_applications.yml            | 2 +-
 3 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/detections/application/cisco_ai_defense_allowed_sensitive_prompt.yml b/detections/application/cisco_ai_defense_allowed_sensitive_prompt.yml
index 31241d97da7..79100e68a43 100644
--- a/detections/application/cisco_ai_defense_allowed_sensitive_prompt.yml
+++ b/detections/application/cisco_ai_defense_allowed_sensitive_prompt.yml
@@ -78,6 +78,7 @@ threat_objects: []
 analytic_story:
     - Abuse of GenAI Systems and Applications
     - Data Protection
+    - Critical Alerts
 asset_type: Web Application
 mitre_attack_id: []
 product:
diff --git a/detections/application/cisco_ai_defense_repeated_high_risk_activity.yml b/detections/application/cisco_ai_defense_repeated_high_risk_activity.yml
index 252b29ce0e4..941b6f2679c 100644
--- a/detections/application/cisco_ai_defense_repeated_high_risk_activity.yml
+++ b/detections/application/cisco_ai_defense_repeated_high_risk_activity.yml
@@ -1,6 +1,6 @@
 name: Cisco AI Defense Repeated High Risk Activity
 id: 45c5cf84-8ad0-4923-8332-a7fd3dab59d4
-version: 2
+version: 1
 creation_date: '2026-10-15'
 modification_date: '2026-10-15'
 author: Nasreddine Bencherchali, Splunk
@@ -70,6 +70,7 @@ finding:
 threat_objects: []
 analytic_story:
     - Abuse of GenAI Systems and Applications
+    - Critical Alerts
 asset_type: Web Application
 mitre_attack_id: []
 product:
diff --git a/stories/abuse_of_genai_systems_and_applications.yml b/stories/abuse_of_genai_systems_and_applications.yml
index 6d60ea73f18..872cc2f0b47 100644
--- a/stories/abuse_of_genai_systems_and_applications.yml
+++ b/stories/abuse_of_genai_systems_and_applications.yml
@@ -6,7 +6,7 @@ modification_date: '2026-10-15'
 author: Nasreddine Bencherchali, Splunk
 status: production
 description: |-
-    Detect and investigate threats targeting or abusing artificial intelligence services and applications.
+    Detect and investigate threats targeting or abusing artificial intelligence systems, services and applications.
     Coverage includes prompt injection, attempts to bypass model safeguards, repeated high-risk guardrail events, and possible sensitive data disclosure through model interactions.
 narrative: |-
     AI applications can expose sensitive information, invoke connected tools, or process untrusted prompts. Attackers and malicious insiders may try to override model instructions, extract restricted data, misuse AI-enabled tools, or repeatedly probe guardrails.

From 533b8d2c478a7fdd472548de1532de51641253f9 Mon Sep 17 00:00:00 2001
From: Nasreddine Bencherchali <nbencher@cisco.com>
Date: Fri, 16 Oct 2026 14:05:25 +0200
Subject: [PATCH 8/9] Update
 detections/application/cisco_ai_defense_security_alerts_by_application_name.yml

Co-authored-by: Onur Mustafa Erdogan <156806007+onurmerdogan@users.noreply.github.com>
---
 .../cisco_ai_defense_security_alerts_by_application_name.yml     | 1 +
 1 file changed, 1 insertion(+)

diff --git a/detections/application/cisco_ai_defense_security_alerts_by_application_name.yml b/detections/application/cisco_ai_defense_security_alerts_by_application_name.yml
index 14b01046cc9..9aba8ccc19f 100644
--- a/detections/application/cisco_ai_defense_security_alerts_by_application_name.yml
+++ b/detections/application/cisco_ai_defense_security_alerts_by_application_name.yml
@@ -122,6 +122,7 @@ intermediate_findings:
 threat_objects: []
 analytic_story:
     - Abuse of GenAI Systems and Applications
+    - Critical Alerts
 asset_type: Web Application
 mitre_attack_id: []
 product:

From e92ee569bdf197ee2705a3f2b72a5f60e3e70a51 Mon Sep 17 00:00:00 2001
From: nasbench <8741929+nasbench@users.noreply.github.com>
Date: Fri, 16 Oct 2026 14:43:53 +0200
Subject: [PATCH 9/9] Update cisco_ai_defense_repeated_high_risk_activity.yml

---
 ...ai_defense_repeated_high_risk_activity.yml | 24 ++++++++++++-------
 1 file changed, 16 insertions(+), 8 deletions(-)

diff --git a/detections/application/cisco_ai_defense_repeated_high_risk_activity.yml b/detections/application/cisco_ai_defense_repeated_high_risk_activity.yml
index 941b6f2679c..d267fb97c78 100644
--- a/detections/application/cisco_ai_defense_repeated_high_risk_activity.yml
+++ b/detections/application/cisco_ai_defense_repeated_high_risk_activity.yml
@@ -7,16 +7,18 @@ author: Nasreddine Bencherchali, Splunk
 status: production
 type: TTP
 description: |-
-    Detects repeated Cisco AI Defense events matching prompt injection, code detection, PII, or PCI guardrails for the same application and connection within ten minutes.
+    Detects bursts of five or more distinct Cisco AI Defense event IDs, or three or more occurrences of the same event ID, matching prompt injection, code detection, PII, or PCI guardrails for the same application and connection within ten minutes.
     Allowed PII/PCI prompt events are handled by Cisco AI Defense Allowed Sensitive Prompt.
-    A burst can indicate iterative probing or repeated attempts to use an AI application to access restricted data or capabilities.
+    These patterns can indicate iterative prompt-injection probing or repeated attempts to use an AI application to access restricted data or capabilities.
 data_source:
     - Cisco AI Defense Alerts
 search: |-
     `cisco_ai_defense`
 
     ```Leave allowed PII/PCI prompt events to Cisco AI Defense Allowed Sensitive Prompt```
-    | where NOT (lower(event_action)="allow" AND lower(event_message_type)="prompt" AND mvfind('event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail_ruleset_type', "(?i)\\bPII\\b|personally identifiable information|\\bPCI\\b|payment card industry")>=0)
+
+    | eval is_allowed_sensitive_prompt=if(lower(event_action)="allow" AND lower(event_message_type)="prompt" AND mvfind('event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail_ruleset_type', "(?i)\\bPII\\b|personally identifiable information|\\bPCI\\b|payment card industry")>=0, 1, 0)
+    | where is_allowed_sensitive_prompt=0
 
     | eval guardrail_ruleset_type=mvjoin('event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail_ruleset_type', ", "),
            application_name=if(isnotnull('genai_application.application_name') AND len(trim('genai_application.application_name'))>0, 'genai_application.application_name', "unknown"),
@@ -28,8 +30,13 @@ search: |-
 
     | bin _time span=10m
 
+    ```Track repeated records with the same Cisco event ID separately from bursts of distinct event IDs```
+    | eventstats count as same_event_id_count by _time application_key connection_key event_id
+
     | stats count as event_count
             dc(event_id) as distinct_event_count
+            max(eval(if(isnotnull(event_id) AND len(trim(event_id))>0, same_event_id_count, 0))) as max_same_event_id_count
+            values(eval(if(isnotnull(event_id) AND len(trim(event_id))>0 AND same_event_id_count>=3, event_id, null()))) as repeated_event_ids
             count(eval(lower(event_action)="allow")) as allowed_event_count
             count(eval(lower(event_action)="block")) as blocked_event_count
             values(event_id) as event_ids
@@ -41,18 +48,19 @@ search: |-
             values(application_name) as application_names
         by _time application_key connection_key
 
-    | where distinct_event_count>=5
+    | where distinct_event_count>=5 OR max_same_event_id_count>=3
 
     | table _time application_key application_names connection_key connection_names
-            distinct_event_count allowed_event_count blocked_event_count event_actions
-            message_types policy_names guardrail_ruleset_types event_ids
+            event_count distinct_event_count max_same_event_id_count repeated_event_ids
+            allowed_event_count blocked_event_count event_actions message_types policy_names
+            guardrail_ruleset_types event_ids
 
     | `cisco_ai_defense_repeated_high_risk_activity_filter`
 how_to_implement: |-
     Install and configure the Cisco Security Cloud app to ingest Cisco AI Defense alerts into Splunk.
     Confirm that extraction is enabled for the required fields as shown in the detection search.
     Configure the "cisco_ai_defense" macro to match the index, source, and sourcetype used in your environment.
-    Adjust the five-event threshold and ten-minute window as needed.
+    Adjust the five-distinct-event threshold, three-occurrence same-event-ID threshold, and ten-minute window as needed.
 known_false_positives: |-
     Automated testing, red-team exercises, application QA, or a popular shared application may generate repeated guardrail events.
     Review whether the window contains allowed events and whether the activity was expected for the application and connection.
@@ -62,7 +70,7 @@ drilldown_searches:
       earliest_offset: $info_min_time$
       latest_offset: $info_max_time$
 finding:
-    title: Cisco AI Defense observed [$distinct_event_count$] high risk events in ten minutes for application [$application_names$] and connection [$connection_names$]. Allowed events -> [$allowed_event_count$] ; Blocked events -> [$blocked_event_count$].
+    title: Cisco AI Defense observed [$event_count$] high risk event occurrences across [$distinct_event_count$] unique event IDs in ten minutes for application [$application_names$] and connection [$connection_names$]. Maximum same-ID count -> [$max_same_event_id_count$] ; Allowed events -> [$allowed_event_count$] ; Blocked events -> [$blocked_event_count$].
     entity:
         field: application_key
         type: other