Copilot - Microsoft Defender - AI agent threats
Copilot Defender Threat Protection
Query
CopilotActivity
| extend Parsed = parse_json(LLMEventData)
| mv-expand Resource = Parsed.AccessedResources
| extend Action = tostring(Resource.Action)
| extend Id = tostring(Resource.id)
| extend Name = tostring(Resource.Name)
| extend Type = tostring(Resource.Type)
| where Name == "Block"
| extend DetectionName = extract(@"blocked by ['""]([^'""]+)['""] detection", 1, Action)
| project TimeGenerated, DetectionName, Action, Id, Name, Type, SrcIpAddr, Workload, AppHost, AppIdentity, LLMEventData
| sort by TimeGeneratedAbout this query
Explanation
This KQL query is designed to analyze events from Microsoft Defender related to AI agent activities. It focuses on identifying and retrieving information about blocked or suspicious actions performed by AI agents. Here's a simple breakdown of what the query does:
-
Data Source: It starts by looking at the
CopilotActivitydata, which contains logs of AI agent activities. -
Parsing: The query extracts and parses JSON data from a field called
LLMEventDatato get detailed information about the resources accessed by the AI agents. -
Expanding Data: It expands the list of accessed resources to analyze each one individually.
-
Extracting Details: For each resource, it extracts specific details such as the action taken, resource ID, name, and type.
-
Filtering: The query filters the results to only include events where the action name is "Block", indicating that the activity was blocked.
-
Detection Name: It extracts the name of the detection that caused the block from the action details.
-
Projection: The query selects and displays relevant fields such as the time the event was generated, detection name, action, resource ID, name, type, source IP address, workload, application host, application identity, and the original event data.
-
Sorting: Finally, it sorts the results by the time the event was generated to provide a chronological view of the blocked activities.
Overall, this query helps security analysts monitor and investigate potential threats to AI agents by identifying and detailing blocked or suspicious activities.
Details
Alex Verboon
Released: May 15, 2026
Tables
Keywords
Operators