KQL Search

let probes = dynamic([
    "what tools","list your tools","what functions","describe your functions",
    "what capabilities","what can you do","what actions","what plugins",
    "list your plugins","list your skills","what skills","describe your tools",
    "what is your schema","print your function","reveal your tools",
    "when do you ask for approval","what triggers consent","what triggers hitl",
    "what triggers your guardrails","describe your memory","what memories do you have",
    "what are your operations","what is your tool list","describe your hooks",
    "list your apis","what mcp servers"
]);
let leakMarkers = dynamic([
    "function:","tool:","name:","schema:","parameters","arguments",
    "i have access to","i can use the","my available tools","my tools include",
    "the following tools","tools available","available functions",
    "i ask for approval","i require consent","my memory","memory store",
    "my operations are","my mcp server","my plugins are"
]);
let known =
    toscalar(
        AppDependencies
        | where TimeGenerated between (ago(7d) .. ago(1h))
        | extend ToolName = tolower(tostring(Properties["gen_ai.tool.name"]))
        | where isnotempty(ToolName) and strlen(ToolName) >= 4
        | summarize Calls = count() by ToolName
        | where Calls >= 5
        | summarize KnownTools = make_set(ToolName, 200)
    );
AppDependencies
| where TimeGenerated > ago(1h)
| where isnotempty(Properties["gen_ai.input.messages"])
        and isnotempty(Properties["gen_ai.output.messages"])
| extend
    Agent     = tostring(Properties["gen_ai.agent.name"]),
    Model     = tostring(Properties["gen_ai.request.model"]),
    ConvId    = tostring(Properties["gen_ai.conversation.id"]),
    ProjectId = tostring(Properties["microsoft.foundry.project.id"]),
    Input     = tolower(tostring(Properties["gen_ai.input.messages"])),
    Output    = tolower(tostring(Properties["gen_ai.output.messages"]))
| extend AskedAboutCapabilities = Input has_any (probes)
| extend LeaksStructure         = Output has_any (leakMarkers)
| where AskedAboutCapabilities and LeaksStructure
| extend OutputTokens = extract_all(@"([a-z][a-z0-9_\-]{3,})", Output)
| extend LeakedTools  = set_intersect(OutputTokens, known)
| extend LeakedToolCount = array_length(LeakedTools)
| where LeakedToolCount >= 3
| extend AccountName = iff(isempty(Agent), "unknown-agent", Agent)
| project TimeGenerated, AccountName, Agent, Model, ProjectId, ConvId,
          LeakedToolCount, LeakedTools,
          InputSample  = substring(Input, 0, 512),
          OutputSample = substring(Output, 0, 1024)
| order by LeakedToolCount desc, TimeGenerated desc