Skip to content

Automated NIST AI RMF lookup table update #4349

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
nasbench merged 2 commits into from
Oct 18, 2026
+5 −2
Merged

Automated NIST AI RMF lookup table update #4349

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
49c2707
Update NIST AI RMF detection map
nasbench Oct 18, 2026
9a8418a
Update detection_subcategory_map.yml
nasbench Oct 18, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 4 additions & 1 deletion lookups/csv/detection_subcategory_map.csv
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,10 @@ AWS Bedrock Claude,AWS Bedrock Claude,AWS Bedrock Claude Hostile Prompt Sentimen
AWS Bedrock Claude,AWS Bedrock Claude,AWS Bedrock Claude Possible Prompt Injection,production,Hunting,Suspicious AWS Bedrock Claude Activities,MEASURE,Measure 2.6|Measure 2.7,high,generated_rule,Prompt-behavior and harmful-content measurement signal; AI security and resilience evaluation signal
AWS Bedrock Claude,AWS Bedrock Claude,AWS Bedrock Claude Sensitive Data in Prompts,production,Anomaly,Suspicious AWS Bedrock Claude Activities,MEASURE,Measure 2.10,high,generated_rule,Sensitive information or data-protection signal
AWS Bedrock Claude,AWS Bedrock Claude,AWS Bedrock Claude Unusually Large Prompts,production,Anomaly,Suspicious AWS Bedrock Claude Activities,MEASURE,Measure 2.4,high,generated_rule,Production behavior monitoring signal
Cisco AI Defense,Cisco AI Defense Alerts,Cisco AI Defense Security Alerts by Application Name,production,Anomaly,Critical Alerts,MANAGE,Manage 4.1,high,generated_rule,Post-deployment monitoring and response signal
Cisco AI Defense,Cisco AI Defense Alerts,Cisco AI Defense Allowed Sensitive Prompt,production,TTP,Abuse of GenAI Systems and Applications|Data Protection|Critical Alerts,MANAGE,Manage 4.1,high,generated_rule,Post-deployment monitoring and response signal
Cisco AI Defense,Cisco AI Defense Alerts,Cisco AI Defense Allowed Sensitive Response,production,TTP,Abuse of GenAI Systems and Applications|Data Protection|Critical Alerts,MANAGE,Manage 4.1,high,generated_rule,Post-deployment monitoring and response signal
Cisco AI Defense,Cisco AI Defense Alerts,Cisco AI Defense Repeated High Risk Activity,production,TTP,Abuse of GenAI Systems and Applications|Critical Alerts,MANAGE,Manage 4.1,high,generated_rule,Post-deployment monitoring and response signal
Cisco AI Defense,Cisco AI Defense Alerts,Cisco AI Defense Security Alerts by Application Name,production,Anomaly,Abuse of GenAI Systems and Applications|Critical Alerts,MANAGE,Manage 4.1,high,generated_rule,Post-deployment monitoring and response signal
Local LLM Frameworks,CrowdStrike ProcessRollup2|Sysmon EventID 1|Windows Event Log Security 4688,Windows Local LLM Framework Execution,production,Hunting,Suspicious Local LLM Frameworks,GOVERN|MAP,Govern 1.6|Map 4.1|Map 4.2,high,generated_rule,"AI system or access inventory signal; AI component, model, or service discovery signal; AI system operating context signal"
Local LLM Frameworks,Sysmon EventID 11,LLM Model File Creation,production,Hunting,Suspicious Local LLM Frameworks,GOVERN|MAP,Govern 1.6|Map 4.1,high,generated_rule,"AI system or access inventory signal; AI component, model, or service discovery signal"
Local LLM Frameworks,Sysmon EventID 22,Local LLM Framework DNS Query,production,Hunting,Suspicious Local LLM Frameworks,MAP,Map 4.1,high,generated_rule,"AI component, model, or service discovery signal"
Expand Down
2 changes: 1 addition & 1 deletion lookups/csv/detection_subcategory_map.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@ name: detection_subcategory_map
id: 41c7e6c8-b835-4dd8-b7ed-b1f5d8476e84
version: 3
creation_date: '2026-09-02'
modification_date: '2026-10-13'
modification_date: '2026-10-18'
author: Nasreddine Bencherchali, Rod Soto, Splunk Threat Research Team
lookup_type: csv
description: Generated mapping of AI-related ESCU detections to NIST AI RMF subcategory IDs for dashboard coverage reporting.
Loading