Network Communication to AI Model Providers

Steven Lim@KQLWizard

•updated Feb 28, 2026•27•0•390

This rule detects network communication with known AI model providers by checking `RemoteUrl` against a list of AI API URLs from an external CSV file. It aims to identify potential unauthorized use of AI services, data exfiltration to AI models, or to monitor AI usage within an environment.