Hunt for local AI Agent activity with Agent Info

Hunt Local AI Agent Activity With Agent Info

Query

// Fill in agent name or one of the Agent IDs you have found
let agent_name = "";
let some_agent_id = "";
AgentsInfo 
| where TimeGenerated > ago(1d)
| summarize arg_max(TimeGenerated, *) by AgentId
| where (isempty(some_agent_id) and Name =~ agent_name) or (isempty(agent_name) and * has some_agent_id)
// Take local AI Agents
| where Platform == "LocalAgents"
| distinct Name, Platform, SourceAgentId
// Join with Graph Nodes to get the ObservabilityID
| join kind=inner (
    ExposureGraphNodes
    | where NodeLabel == "ai-agent"
    | where parse_json(NodeProperties).rawData.aiAgentMetadata.platform == "LocalAgents"
    | extend SourceAIAgentId = extract("{\"type\":\"SourceAIAgentId\",\"id\":\"([^\"]+)\"}", 1, tostring(EntityIds))
    | extend A365RegistryAIAgentId = extract("{\"type\":\"A365RegistryAIAgentId\",\"id\":\"tenantid=([^;]+);titleid=([^\"]+)\"}", 2, tostring(EntityIds))
    | project SourceAIAgentId, A365RegistryAIAgentId
) on $left.SourceAgentId == $right.SourceAIAgentId
| extend ExtractedObservabilityID = iff(
    A365RegistryAIAgentId matches regex @"(\{{0,1}([0-9a-fA-F]){8}-([0-9a-fA-F]){4}-([0-9a-fA-F]){4}-([0-9a-fA-F]){4}-([0-9a-fA-F]){12}\}{0,1})",
    extract(@"(\{{0,1}([0-9a-fA-F]){8}-([0-9a-fA-F]){4}-([0-9a-fA-F]){4}-([0-9a-fA-F]){4}-([0-9a-fA-F]){12}\}{0,1})", 1, A365RegistryAIAgentId),
    A365RegistryAIAgentId
)
| join kind=inner (
    CloudAppEvents
    | where ActionType in ("InvokeAgent","InferenceCall","ExecuteToolBySDK","ExecuteToolByGateway","ExecuteToolByMCPServer")
    // Extract the platformIDs and ObservabilityID
    | extend PlatformAgentId = tostring(parse_json(RawEventData)["PlatformAgentId"]), 
        PlatformTargetAgentId = tostring(parse_json(RawEventData)["PlatformTargetAgentId"])
    | extend PlatformId = iff(isempty(PlatformAgentId) and isnotempty(PlatformTargetAgentId), PlatformTargetAgentId, PlatformAgentId)
    | extend ObservabilityID = iff(
        PlatformId matches regex @"(\{{0,1}([0-9a-fA-F]){8}-([0-9a-fA-F]){4}-([0-9a-fA-F]){4}-([0-9a-fA-F]){4}-([0-9a-fA-F]){12}\}{0,1})", 
        extract(@"(\{{0,1}([0-9a-fA-F]){8}-([0-9a-fA-F]){4}-([0-9a-fA-F]){4}-([0-9a-fA-F]){4}-([0-9a-fA-F]){12}\}{0,1})", 1, PlatformId),
        PlatformId
    )
) on $left.ExtractedObservabilityID == $right.ObservabilityID

About this query

Hunt for local AI Agent activity with Agent Info

Query Information

MITRE ATT&CK Technique(s)

Technique ID	Title	Link

Description

This query allows you to find the activity a local AI Agent performed via the CloudAppEvents table using the AgentsInfo and ExposureGraphNodes table.

Risk

With this query a SOC Analysts can find the events a local AI Agent performed.

Author <Optional>

Name: Robbe Van den Daele
Github: https://github.com/RobbeVandenDaele
Twitter: https://x.com/RobbeVdDaele
LinkedIn: https://www.linkedin.com/in/robbe-van-den-daele-677986190/
Website: https://hybridbrothers.com/

References

https://hybridbrothers.com/posts/agentinfo-cloudappevents-correlation/

Defender XDR

Explanation

This query is designed to help security analysts track the activities of local AI agents within a system. Here's a simplified breakdown of what the query does:

Define Variables: It starts by allowing you to specify an agent name or ID that you are interested in investigating.
Retrieve Agent Information: It looks into the AgentsInfo table to find the most recent information about AI agents, filtering for those that are running on local platforms.
Identify Relevant Agents: It filters the agents to only include those that are categorized as "LocalAgents."
Join with Graph Data: The query then joins this information with the ExposureGraphNodes table to get additional details, such as the Observability ID, which is a unique identifier for tracking purposes.
Extract Observability ID: It extracts the Observability ID from the data, ensuring it is in a standardized format.
Join with Cloud Events: Finally, it joins this enriched agent data with the CloudAppEvents table to find specific actions performed by the AI agents. These actions include invoking the agent, making inference calls, and executing tools through various methods.
Filter Actions: It specifically looks for actions related to invoking or executing tools by the AI agents, ensuring that only relevant activities are captured.

Overall, this query helps security analysts monitor and investigate the actions of local AI agents by correlating data from different sources to provide a comprehensive view of their activities.

Details

Robbe Van den Daele

Released: July 11, 2026

Tables

AgentsInfoExposureGraphNodesCloudAppEvents

Keywords

AgentsInfoExposureGraphNodesCloudAppEventsTimeGeneratedAgentIdNamePlatformSourceAgentIdNodeLabelNodePropertiesEntityIdsSourceAIAgentIdA365RegistryAIAgentIdExtractedObservabilityIDActionTypeRawEventDataPlatformAgentIdPlatformTargetAgentIdPlatformIdObservabilityID

Operators

letagosummarizearg_maxbywhereisemptyandhasdistinctjoinkindonextendextracttostringprojectiffmatchesregexinparse_jsonisnotempty

Actions

GitHub

KQL Search