Users Running Multiple Local AI Agents

Identifies user accounts associated with three or more local AI agents and lists the agents and devices observed for each user, helping highlight users with significant AI agent activity.

Microsoft Sentinel (KQL)