DET-MS-SEN-002 Microsoft Sentinel Network KQL Severity: Low
First-seen consumer LLM domain in environment
Surfaces newly emerging consumer LLM service domains observed in network telemetry for the first time, prompting watchlist updates and AUP enforcement.
Rule
// New consumer LLM domains observed in last 7 days
let known = _GetWatchlist('ConsumerLLMDomains') | project SearchKey;
let candidatePatterns = dynamic(['chat', 'gpt', 'claude', 'gemini', 'copilot', 'mistral', 'qwen', 'deepseek', 'perplex', 'llm.ai', 'grok']);
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where ActionType == 'ConnectionSuccess'
| extend Domain = tostring(parse_url(RemoteUrl).Host)
| where isnotempty(Domain)
| where Domain has_any (candidatePatterns)
| where Domain !in (known)
| summarize FirstSeen = min(Timestamp),
UniqueUsers = dcount(InitiatingProcessAccountUpn),
UniqueDevices = dcount(DeviceName),
Sample = take_any(RemoteUrl)
by Domain
| where UniqueUsers >= 2
| order by FirstSeen desc// New consumer LLM domains observed in last 7 days
let known = _GetWatchlist('ConsumerLLMDomains') | project SearchKey;
let candidatePatterns = dynamic(['chat', 'gpt', 'claude', 'gemini', 'copilot', 'mistral', 'qwen', 'deepseek', 'perplex', 'llm.ai', 'grok']);
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where ActionType == 'ConnectionSuccess'
| extend Domain = tostring(parse_url(RemoteUrl).Host)
| where isnotempty(Domain)
| where Domain has_any (candidatePatterns)
| where Domain !in (known)
| summarize FirstSeen = min(Timestamp),
UniqueUsers = dcount(InitiatingProcessAccountUpn),
UniqueDevices = dcount(DeviceName),
Sample = take_any(RemoteUrl)
by Domain
| where UniqueUsers >= 2
| order by FirstSeen desc How it works
Pattern-based discovery of new LLM-adjacent domains not yet on the watchlist. Investigates suspected new services with at least two distinct users.
Required data sources
- Microsoft Defender for Endpoint (DeviceNetworkEvents)
- Sentinel watchlist: ConsumerLLMDomains
Prerequisites
- Microsoft 365 E5 or Defender for Endpoint P2
- Existing watchlist deployed (DET-MS-SEN-001 prerequisites)
Expected volume
Low — 1–10 candidate domains per week. Triage takes minutes per domain.
False-positive guidance
Many domains will match the pattern but not be LLM services (e.g., generic 'gpt.example.com' for a non-AI product). Triage manually before adding to watchlist.
Tuning steps
- Refine candidatePatterns list as new naming conventions emerge.
- Lower UniqueUsers threshold to 1 if you want very-early signal.
- Add an exclusion list of confirmed-not-LLM domains to reduce repeat triage.
Framework mappings
- NIST AI RMF: GOVERN-4.1, MANAGE-4.1
- ISO/IEC 42001: 8.2
- NIST CSF: DE.CM-7