Hunt for AI Agent activity with Agent Info

Hunt AI Agent Activity With Agent Info

Query

// Fill in agent name or one of the Agent IDs you have found
let agent_name = "";
let some_agent_id = "";
AgentsInfo 
| where TimeGenerated > ago(1d)
| summarize arg_max(TimeGenerated, *) by AgentId
| where (isempty(some_agent_id) and Name =~ agent_name) or (isempty(agent_name) and * has some_agent_id)
// Skip local AI Agents
| where Platform != "LocalAgents"
| extend ExtractedObservabilityID = iff(
    ObservabilityID matches regex @"(\{{0,1}([0-9a-fA-F]){8}-([0-9a-fA-F]){4}-([0-9a-fA-F]){4}-([0-9a-fA-F]){4}-([0-9a-fA-F]){12}\}{0,1})",
    extract(@"(\{{0,1}([0-9a-fA-F]){8}-([0-9a-fA-F]){4}-([0-9a-fA-F]){4}-([0-9a-fA-F]){4}-([0-9a-fA-F]){12}\}{0,1})", 1, ObservabilityID),
    ObservabilityID
)
// Add fallback on titleId if ObservabilityID is empty
| extend ExtractedObservabilityID = iff(ExtractedObservabilityID == "", extract(@"(\{{0,1}([0-9a-fA-F]){8}-([0-9a-fA-F]){4}-([0-9a-fA-F]){4}-([0-9a-fA-F]){4}-([0-9a-fA-F]){12}\}{0,1})", 1, tostring(parse_json(RawAgentInfo).titleId)), ExtractedObservabilityID)
| project Name, Platform, ExtractedObservabilityID
| join kind=inner (
    CloudAppEvents
    | where TimeGenerated > ago(7d)
    | where ActionType in ("InvokeAgent","InferenceCall","ExecuteToolBySDK","ExecuteToolByGateway","ExecuteToolByMCPServer")
    // Extract the platformIDs and ObservabilityID
    | extend PlatformAgentId = tostring(parse_json(RawEventData)["PlatformAgentId"]), 
        PlatformTargetAgentId = tostring(parse_json(RawEventData)["PlatformTargetAgentId"])
    | extend PlatformId = iff(isempty(PlatformAgentId) and isnotempty(PlatformTargetAgentId), PlatformTargetAgentId, PlatformAgentId)
    | extend ObservabilityID = iff(
        PlatformId matches regex @"(\{{0,1}([0-9a-fA-F]){8}-([0-9a-fA-F]){4}-([0-9a-fA-F]){4}-([0-9a-fA-F]){4}-([0-9a-fA-F]){12}\}{0,1})", 
        extract(@"(\{{0,1}([0-9a-fA-F]){8}-([0-9a-fA-F]){4}-([0-9a-fA-F]){4}-([0-9a-fA-F]){4}-([0-9a-fA-F]){12}\}{0,1})", 1, PlatformId),
        PlatformId
    )
) on $left.ExtractedObservabilityID == $right.ObservabilityID

About this query

Hunt for AI Agent activity with Agent Info

Query Information

MITRE ATT&CK Technique(s)

Technique ID	Title	Link

Description

This query allows you to find the activity an AI Agent performed via the CloudAppEvents table using the AgentsInfo table.

Risk

With this query a SOC Analysts can find the events an AI Agent performed.

Author <Optional>

Name: Robbe Van den Daele
Github: https://github.com/RobbeVandenDaele
Twitter: https://x.com/RobbeVdDaele
LinkedIn: https://www.linkedin.com/in/robbe-van-den-daele-677986190/
Website: https://hybridbrothers.com/

References

https://hybridbrothers.com/posts/agentinfo-cloudappevents-correlation/

Defender XDR

Explanation

This KQL query is designed to identify and analyze activities performed by AI Agents using data from two tables: AgentsInfo and CloudAppEvents. Here's a simplified breakdown of what the query does:

Agent Identification:
- The query starts by setting up variables for an agent's name or ID, which can be filled in by the user to specify the AI Agent of interest.
Data Filtering from AgentsInfo Table:
- It retrieves the most recent information about each agent from the AgentsInfo table, filtering out data older than one day.
- It checks if the agent matches the specified name or ID.
- Local AI Agents are excluded from the results.
Observability ID Extraction:
- The query extracts a unique identifier (ObservabilityID) for each agent, using a regex pattern to ensure it captures a valid format.
- If the ObservabilityID is missing, it attempts to extract it from a different field (titleId).
Data Filtering from CloudAppEvents Table:
- The query then looks at the CloudAppEvents table for events that occurred in the past seven days.
- It focuses on specific action types related to AI Agent activities, such as invoking an agent or executing a tool.
- It extracts and processes identifiers from the event data to match them with the ObservabilityID.
Data Correlation:
- Finally, it joins the processed data from both tables based on the extracted ObservabilityID, allowing it to correlate agent information with the events they performed.

In summary, this query helps security analysts track and investigate the activities of AI Agents by correlating agent information with their actions recorded in cloud application events.

Details

Robbe Van den Daele

Released: July 11, 2026

Tables

AgentsInfoCloudAppEvents

Keywords

AgentsInfoCloudAppEventsPlatformActionTypeObservabilityIDRawEventData

Operators

letagosummarizearg_maxbywhereisemptyandorhasmatches regexextractiffparse_jsontostringprojectjoinkindinisnotemptyon

Actions

GitHub

KQL Search