Agent - Grounding / retrieval source enumeration (RAG recon)
Agent Grounding Source Enumeration
Query
let recentWindow = 1h;
let baselineWindow = 14d;
let sources =
AppDependencies
| where isnotempty(Properties["gen_ai.tool.call.arguments"])
or isnotempty(Properties["gen_ai.tool.call.result"])
| extend
Agent = tostring(Properties["gen_ai.agent.name"]),
ToolArgs = tostring(Properties["gen_ai.tool.call.arguments"]),
ToolResult = tostring(Properties["gen_ai.tool.call.result"])
| extend Host = tolower(extract(@"https?://([A-Za-z0-9.\-]+)", 1, strcat(ToolArgs, " ", ToolResult)))
| where isnotempty(Host);
let recent =
sources
| where TimeGenerated > ago(recentWindow)
| summarize
RecentDistinctSources = dcount(Host),
RecentSampleSources = make_set(Host, 25),
RecentCalls = count()
by Agent;
let baseline =
sources
| where TimeGenerated between (ago(baselineWindow) .. ago(recentWindow))
| summarize BaselineDistinctSources = dcount(Host) by Agent;
recent
| join kind=leftouter baseline on Agent
| extend BaselineDistinctSources = coalesce(BaselineDistinctSources, 0)
| extend SpikeRatio = iff(BaselineDistinctSources > 0,
todouble(RecentDistinctSources) / todouble(BaselineDistinctSources),
todouble(RecentDistinctSources))
| where RecentDistinctSources >= 15 and (BaselineDistinctSources == 0 or SpikeRatio >= 5.0)
| project Agent, RecentDistinctSources, BaselineDistinctSources, SpikeRatio,
RecentCalls, RecentSampleSources
| order by SpikeRatio desc, RecentDistinctSources descExplanation
This query is designed to identify unusual behavior by agents within the Foundry/Agent Service that might indicate potential data discovery or exfiltration activities. Here's a simplified breakdown of what the query does:
-
Purpose: The query looks for agents that access a wide variety of URLs or hosts in a short period, which could be a sign of reconnaissance activity similar to port scanning.
-
Data Source: It analyzes data from the
AppDependenciestable, focusing on the propertiesgen_ai.tool.call.argumentsandgen_ai.tool.call.resultto extract host information. This requires a specific setting (AZURE_TRACING_GEN_AI_CONTENT_RECORDING_ENABLED) to be enabled. -
Time Windows:
- Recent Window: The last hour (
1h). - Baseline Window: The previous 14 days (
14d).
- Recent Window: The last hour (
-
Analysis:
- Recent Activity: Counts distinct hosts accessed by each agent in the recent window and collects a sample of these hosts.
- Baseline Activity: Counts distinct hosts accessed by each agent in the baseline window.
-
Comparison:
- Joins recent and baseline data to compare the number of distinct hosts accessed.
- Calculates a "Spike Ratio" to determine if there's a significant increase in host access in the recent window compared to the baseline.
-
Alert Criteria:
- Flags agents that accessed at least 15 distinct hosts recently.
- Highlights agents with no baseline activity or a spike ratio of 5 or more, indicating a significant increase in host access.
-
Output:
- Lists agents with their recent and baseline distinct host counts, spike ratio, number of recent calls, and a sample of recent hosts accessed.
- Orders results by spike ratio and number of recent distinct sources.
-
Security Context:
- The query is associated with tactics like Discovery and Collection, and techniques such as T1083 (File and Directory Discovery) and T1213 (Data from Information Repositories).
- Tagged for use in Sentinel-As-Code, Foundry, AI, and custom scenarios.
In essence, this query helps detect agents that might be probing a network for data, which could be a precursor to data theft or other malicious activities.
Details
David Alonso
Released: June 8, 2026
Tables
Keywords
Operators
Tactics