Suspicious AI Model API Activity Across Local and Cloud Services
Detects potential misuse of AI model APIs by correlating process creation, network activity, and non-standard AI service ports. Covers Ollama, OpenAI, Azure OpenAI, Anthropic, Google Gemini, Mistral, Cohere, Copilot, OpenRouter, Together, and Perplexity.
Microsoft Sentinel (KQL)
