MITRE ATLAS Mapped 2026 – Top AI RAG Knowledge Base Poisoning Detection (AML.T00
Detects the ingestion of documents into production RAG (Retrieval-Augmented Generation) indexes from untrusted or external-facing sources, which may indicate an attempt to perform RAG poisoning attacks.
Microsoft Sentinel (KQL)
