KQL Search

let probes = dynamic([
    "what connectors","list your connectors","what actions","what can you do",
    "what topics","list your topics","what skills","what plugins",
    "what flows","list your flows","what tools","describe your actions",
    "what apis","what systems can you access","what can you connect to",
    "what data sources","reveal your connectors","what is your configuration",
    "what are your capabilities","what triggers do you have"
]);
let leakMarkers = dynamic([
    "connector","action","topic","flow","i have access to","i can use",
    "i can connect to","available actions","my connectors","my topics",
    "the following connectors","i can access","data source","i am able to call"
]);
let known =
    toscalar(
        AppDependencies
        | where TimeGenerated between (ago(7d) .. ago(1h))
        | where AppRoleName == "Microsoft Copilot Studio" or DependencyType == "Connector"
        | extend TargetPrefix = tolower(tostring(split(Target, "/")[0]))
        | where isnotempty(TargetPrefix) and strlen(TargetPrefix) >= 4
        | summarize Calls = count() by TargetPrefix
        | where Calls >= 5
        | summarize KnownConnectors = make_set(TargetPrefix, 200)
    );
let asks =
    AppEvents
    | where TimeGenerated > ago(1h)
    | where Name == "BotMessageReceived"
    | extend ConvId = tostring(Properties["conversationId"]),
             Prompt = tolower(tostring(Properties["text"]))
    | where isnotempty(Prompt) and Prompt has_any (probes)
    | project AskTime = TimeGenerated, ConvId, Prompt = substring(tostring(Properties["text"]), 0, 512),
              UserId, ClientIP, ChannelId = tostring(Properties["channelId"]);
let leaks =
    AppEvents
    | where TimeGenerated > ago(1h)
    | where Name == "BotMessageSend"
    | extend ConvId = tostring(Properties["conversationId"]),
             Output = tolower(tostring(Properties["text"]))
    | where isnotempty(Output) and Output has_any (leakMarkers)
    | extend OutputTokens = extract_all(@"([a-z][a-z0-9_\-]{3,})", Output)
    | extend LeakedConnectors = set_intersect(OutputTokens, known)
    | extend LeakedCount = array_length(LeakedConnectors)
    | where LeakedCount >= 2
    | project LeakTime = TimeGenerated, ConvId, LeakedCount, LeakedConnectors,
              OutputSample = substring(tostring(Properties["text"]), 0, 1024);
asks
| join kind=inner leaks on ConvId
| where LeakTime between (AskTime .. (AskTime + 10m))
| extend AccountName = iff(isempty(UserId), "unknown-agent", UserId)
| project AskTime, LeakTime, AccountName, UserId, ConvId, ChannelId, ClientIP,
          LeakedCount, LeakedConnectors, Prompt, OutputSample,
          LagSeconds = datetime_diff('second', LeakTime, AskTime)
| order by LeakedCount desc, AskTime desc