Artifical Intelligence Tools usage
The current AI ecosystem has significant security gaps that can be weaponized for corporate espionage, supply-chain compromise, data harvesting, and even nation-state operations. This KQL query identifies endpoints that are accessing, installing, or executing AI-related services or applications. The primary objective is to detect : - Unauthorized AI usage (Policy Violation) - Potential data exfiltration via AI platforms - Shadow IT activity involving local or cloud-based LLMs - High-risk AI deployments that bypass corporate policy
Microsoft Sentinel (KQL)
