Elastic medium stable kql

Potential Azure OpenAI Model Theft

Monitors for suspicious activities that may indicate theft or unauthorized duplication of machine learning (ML) models, such as unauthorized API calls, atypical access patterns, or large data transfers that are unusual during model interactions.

View Source

Detection Logic

from logs-azure_openai.logs-*
| where
    azure.open_ai.operation_name == "ListKey" and
    azure.open_ai.category == "Audit"
| keep
    @timestamp,
    azure.open_ai.operation_name,
    azure.open_ai.category,
    azure.resource.group,
    azure.resource.name,
    azure.open_ai.properties.response_length
| stats
    Esql.event_count = count(*),
    Esql.azure_open_ai_properties_response_length_max = max(azure.open_ai.properties.response_length)
  by
    azure.resource.group,
    azure.resource.name
| where
    Esql.event_count >= 100 or
    Esql.azure_open_ai_properties_response_length_max >= 1000000
| sort
    Esql.event_count desc

False Positives

⚠ Authorized model training
⚠ Legitimate high volume data exchanges during scheduled updates

Field Validations

Loading…

Comments (0)

Loading comments...