Detection engineering

Surfaces callbacks that re-enter a privileged automation from a source address never seen during registration — a signal for callback-authorization abuse.

Data source

Azure Monitor / Application Insights AppRequests

Required fields

TimeGenerated, ClientIP, Url, ResultCode, ClientType

Last reviewed

2026-08-31

Last tested

Not independently executed; validate in the target workspace before production use.

Known limitations

Application Insights may mask ClientIP. Proxies, NAT, and changing egress addresses can make source identity unreliable.

False positives

New deployments, rotating egress IPs, health checks, and legitimate registration changes.

// Callbacks hitting the integration endpoint from a source
// that never appeared during the registration/handshake phase.
let lookback = 14d;
let known_sources =
    AppRequests
    | where TimeGenerated > ago(lookback)
    | where Url has "/integration/register"
    | where isnotempty(ClientIP)
    | summarize by ClientIP;
AppRequests
| where TimeGenerated > ago(1d)
| where Url has "/integration/callback"
| where isnotempty(ClientIP)
| where ClientIP !in (known_sources)
| project TimeGenerated, ClientIP, Url, ResultCode, ClientType
| order by TimeGenerated desc

Matches tool-call events that a trusted upstream normalizer has already identified as exceeding the delegated scope. Sigma does not perform the scope-set comparison itself.

Data source

Normalized AI gateway / tool-call audit events

Required fields

event_type, authorization.scope_violation, agent_id, tool_name, requested_scope, granted_scope

Last reviewed

2026-08-31

Last tested

Not independently executed; map the custom log source and fields before use.

Known limitations

Requires an upstream, policy-aware set comparison that emits authorization.scope_violation. Sigma only matches the resulting Boolean signal.

False positives

Policy-mapping drift, stale authorization caches, and explicitly approved service-to-service delegation.

title: AI Agent Tool Call Exceeds Delegated Scope
status: experimental
description: Matches a scope violation precomputed by a trusted authorization normalizer.
logsource:
  product: ai_gateway
  service: tool_calls
detection:
  selection:
    event_type: 'tool_invocation'
    'authorization.scope_violation': true
  condition: selection
fields:
  - agent_id
  - tool_name
  - requested_scope
  - granted_scope
  - authorization.scope_violation
falsepositives:
  - Policy mapping drift or stale authorization state
  - Explicitly approved service-to-service delegation
level: high

Flags deferred/async jobs that resume with higher privileges than the request that queued them, indicating a re-authorization gap.

Data source

Normalized Splunk task-runner events

Required fields

task_id, event_type, privilege_rank, agent_id, tool_name

Last reviewed

2026-08-31

Last tested

Not independently executed; validate field extraction and rank semantics before use.

Known limitations

Requires stable task IDs, both enqueue and execute events within retention, and a locally defined numeric privilege_rank.

False positives

Approved privilege changes, administrative retries, duplicated task IDs, and replayed events.

index=ai_platform sourcetype=task_runner
    (event_type="task_enqueued" OR event_type="task_executed")
| stats earliest(_time) as first_seen
        latest(_time) as last_seen
        earliest(eval(if(event_type="task_enqueued", privilege_rank, null()))) as enqueue_privilege_rank
        latest(eval(if(event_type="task_executed", privilege_rank, null()))) as execute_privilege_rank
        latest(agent_id) as agent_id
        latest(tool_name) as tool_name
  by task_id
| where isnotnull(enqueue_privilege_rank)
    AND isnotnull(execute_privilege_rank)
    AND execute_privilege_rank > enqueue_privilege_rank
| table first_seen last_seen task_id agent_id tool_name enqueue_privilege_rank execute_privilege_rank