From 49c27078de26b5059ff09eeaf944cf31c818cb41 Mon Sep 17 00:00:00 2001 From: nasbench <8741929+nasbench@users.noreply.github.com> Date: Sun, 18 Oct 2026 06:44:12 +0000 Subject: [PATCH 1/2] Update NIST AI RMF detection map --- lookups/csv/detection_subcategory_map.csv | 5 ++++- lookups/csv/detection_subcategory_map.yml | 4 ++-- 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/lookups/csv/detection_subcategory_map.csv b/lookups/csv/detection_subcategory_map.csv index 25cf98922b..de28148840 100644 --- a/lookups/csv/detection_subcategory_map.csv +++ b/lookups/csv/detection_subcategory_map.csv @@ -6,7 +6,10 @@ AWS Bedrock Claude,AWS Bedrock Claude,AWS Bedrock Claude Hostile Prompt Sentimen AWS Bedrock Claude,AWS Bedrock Claude,AWS Bedrock Claude Possible Prompt Injection,production,Hunting,Suspicious AWS Bedrock Claude Activities,MEASURE,Measure 2.6|Measure 2.7,high,generated_rule,Prompt-behavior and harmful-content measurement signal; AI security and resilience evaluation signal AWS Bedrock Claude,AWS Bedrock Claude,AWS Bedrock Claude Sensitive Data in Prompts,production,Anomaly,Suspicious AWS Bedrock Claude Activities,MEASURE,Measure 2.10,high,generated_rule,Sensitive information or data-protection signal AWS Bedrock Claude,AWS Bedrock Claude,AWS Bedrock Claude Unusually Large Prompts,production,Anomaly,Suspicious AWS Bedrock Claude Activities,MEASURE,Measure 2.4,high,generated_rule,Production behavior monitoring signal -Cisco AI Defense,Cisco AI Defense Alerts,Cisco AI Defense Security Alerts by Application Name,production,Anomaly,Critical Alerts,MANAGE,Manage 4.1,high,generated_rule,Post-deployment monitoring and response signal +Cisco AI Defense,Cisco AI Defense Alerts,Cisco AI Defense Allowed Sensitive Prompt,production,TTP,Abuse of GenAI Systems and Applications|Data Protection|Critical Alerts,MANAGE,Manage 4.1,high,generated_rule,Post-deployment monitoring and response signal +Cisco AI Defense,Cisco AI Defense Alerts,Cisco AI Defense Allowed Sensitive Response,production,TTP,Abuse of GenAI Systems and Applications|Data Protection|Critical Alerts,MANAGE,Manage 4.1,high,generated_rule,Post-deployment monitoring and response signal +Cisco AI Defense,Cisco AI Defense Alerts,Cisco AI Defense Repeated High Risk Activity,production,TTP,Abuse of GenAI Systems and Applications|Critical Alerts,MANAGE,Manage 4.1,high,generated_rule,Post-deployment monitoring and response signal +Cisco AI Defense,Cisco AI Defense Alerts,Cisco AI Defense Security Alerts by Application Name,production,Anomaly,Abuse of GenAI Systems and Applications|Critical Alerts,MANAGE,Manage 4.1,high,generated_rule,Post-deployment monitoring and response signal Local LLM Frameworks,CrowdStrike ProcessRollup2|Sysmon EventID 1|Windows Event Log Security 4688,Windows Local LLM Framework Execution,production,Hunting,Suspicious Local LLM Frameworks,GOVERN|MAP,Govern 1.6|Map 4.1|Map 4.2,high,generated_rule,"AI system or access inventory signal; AI component, model, or service discovery signal; AI system operating context signal" Local LLM Frameworks,Sysmon EventID 11,LLM Model File Creation,production,Hunting,Suspicious Local LLM Frameworks,GOVERN|MAP,Govern 1.6|Map 4.1,high,generated_rule,"AI system or access inventory signal; AI component, model, or service discovery signal" Local LLM Frameworks,Sysmon EventID 22,Local LLM Framework DNS Query,production,Hunting,Suspicious Local LLM Frameworks,MAP,Map 4.1,high,generated_rule,"AI component, model, or service discovery signal" diff --git a/lookups/csv/detection_subcategory_map.yml b/lookups/csv/detection_subcategory_map.yml index dbf0a875df..6834d891dc 100644 --- a/lookups/csv/detection_subcategory_map.yml +++ b/lookups/csv/detection_subcategory_map.yml @@ -1,8 +1,8 @@ name: detection_subcategory_map id: 41c7e6c8-b835-4dd8-b7ed-b1f5d8476e84 -version: 3 +version: 4 creation_date: '2026-09-02' -modification_date: '2026-10-13' +modification_date: '2026-10-18' author: Nasreddine Bencherchali, Rod Soto, Splunk Threat Research Team lookup_type: csv description: Generated mapping of AI-related ESCU detections to NIST AI RMF subcategory IDs for dashboard coverage reporting. From 9a8418adb9d64c4efc56db0454ebbdbda5f8b597 Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Sun, 18 Oct 2026 19:47:16 +0200 Subject: [PATCH 2/2] Update detection_subcategory_map.yml --- lookups/csv/detection_subcategory_map.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lookups/csv/detection_subcategory_map.yml b/lookups/csv/detection_subcategory_map.yml index 6834d891dc..e6b1ec04cc 100644 --- a/lookups/csv/detection_subcategory_map.yml +++ b/lookups/csv/detection_subcategory_map.yml @@ -1,6 +1,6 @@ name: detection_subcategory_map id: 41c7e6c8-b835-4dd8-b7ed-b1f5d8476e84 -version: 4 +version: 3 creation_date: '2026-09-02' modification_date: '2026-10-18' author: Nasreddine Bencherchali, Rod Soto, Splunk Threat Research Team