Splunk unknown stable spl

AWS Bedrock Claude Unusually Large Prompts

This detection identifies unusually large prompts sent to AWS Bedrock Claude models by calculating the statistical baseline of input token counts and flagging requests that exceed one standard deviations above the mean. Abnormally large prompts may indicate prompt injection attacks, data exfiltration attempts, or abuse of the AI service.

View Source

Detection Logic

`aws_bedrock_claude`
| rename "input.inputTokenCount" AS input_tokens
| rename "identity.arn" AS user_arn
| rename "accountId" AS account_id
| rex field=user_arn "assumed-role/[^/]+/(?<user>[^\"]+)$"
| eval input_tokens=tonumber(input_tokens)
| where input_tokens>0
| eventstats avg(input_tokens) AS avg_tokens stdev(input_tokens) AS stdev
| where input_tokens > avg_tokens + (1*stdev)
| where input_tokens > 1000
| table _time, modelId, user, user_arn, account_id, input_tokens, avg_tokens, host
| sort - input_tokens
| `aws_bedrock_claude_unusually_large_prompts_filter`

False Positives

⚠ Possible false positives may arise from legitimate user interactions with the AI model that require large input prompts, such as complex queries or multi-turn conversations. It is important to review the context of the detected prompts to determine if they represent actual prompt injection attempts or benign usage.

Field Validations

Loading…

Comments (0)

Loading comments...