Create custom analytics rules for agent anomaly detection
Implementation Effort: Medium – Requires writing KQL queries against AI workload telemetry tables, defining baseline behavior for agent identities, and iterating on thresholds through testing against real data.
User Impact: Low – Detection rules run in the background; end users are not affected.
Overview
Built-in analytics rule templates cover known AI threat patterns, but every organization's AI deployment is different. The agents an organization builds, the data they access, the APIs they call, and the identities they use create a unique behavioral baseline that no generic template can fully capture. Custom analytics rules fill this gap by detecting anomalies specific to the organization's agent population — an agent identity making API calls outside its normal hours, a sudden spike in token consumption from a single agent, or an agent accessing data sources it has never queried before.
These are the detections that only the organization can build, because they require knowledge of what normal agent behavior looks like in that specific environment. The built-in rules detect known bad patterns; custom rules detect deviations from known good patterns. Both are necessary — and without custom rules, an entire class of AI threats goes undetected.
This supports Assume breach by detecting behavioral anomalies that indicate an agent identity may be compromised or manipulated, even when the specific attack technique is novel and not covered by built-in detection templates. It supports Verify explicitly by continuously validating agent behavior against organization-specific baselines, rather than relying solely on static rule templates that cannot account for the organization's unique AI workload patterns. Without custom analytics rules, the SOC has no mechanism to detect anomalous agent behavior that falls outside the scope of Microsoft's built-in detections.