Sentinel — AI service usage spike detection (anomaly)
Anomaly detection rule in Microsoft Sentinel that identifies sudden spikes in AI service traffic per user, indicating potential bulk data exfiltration or new Shadow AI adoption patterns.
Rule
// Detect anomalous spikes in AI service usage per user
// Compares current-day connection count against 14-day baseline per user
let llmDomains = _GetWatchlist('ConsumerLLMDomains') | project SearchKey;
let lookback = 14d;
let baseline = DeviceNetworkEvents
| where Timestamp between (ago(lookback) .. ago(1d))
| where ActionType == 'ConnectionSuccess'
| extend Domain = tostring(parse_url(RemoteUrl).Host)
| where Domain in (llmDomains)
| summarize DailyCount = count() by Day = bin(Timestamp, 1d), InitiatingProcessAccountUpn
| summarize AvgDaily = avg(DailyCount), StdDevDaily = stdev(DailyCount) by InitiatingProcessAccountUpn;
DeviceNetworkEvents
| where Timestamp > ago(1d)
| where ActionType == 'ConnectionSuccess'
| extend Domain = tostring(parse_url(RemoteUrl).Host)
| where Domain in (llmDomains)
| summarize TodayCount = count(), Domains = make_set(Domain, 20) by InitiatingProcessAccountUpn
| join kind=inner baseline on InitiatingProcessAccountUpn
| extend Threshold = AvgDaily + (3 * StdDevDaily)
| where TodayCount > Threshold and TodayCount > 20
| extend AnomalyScore = round((TodayCount - AvgDaily) / iff(StdDevDaily == 0, 1.0, StdDevDaily), 2)
| project InitiatingProcessAccountUpn, TodayCount, AvgDaily = round(AvgDaily, 1), StdDevDaily = round(StdDevDaily, 1), Threshold = round(Threshold, 1), AnomalyScore, Domains
| order by AnomalyScore desc// Detect anomalous spikes in AI service usage per user
// Compares current-day connection count against 14-day baseline per user
let llmDomains = _GetWatchlist('ConsumerLLMDomains') | project SearchKey;
let lookback = 14d;
let baseline = DeviceNetworkEvents
| where Timestamp between (ago(lookback) .. ago(1d))
| where ActionType == 'ConnectionSuccess'
| extend Domain = tostring(parse_url(RemoteUrl).Host)
| where Domain in (llmDomains)
| summarize DailyCount = count() by Day = bin(Timestamp, 1d), InitiatingProcessAccountUpn
| summarize AvgDaily = avg(DailyCount), StdDevDaily = stdev(DailyCount) by InitiatingProcessAccountUpn;
DeviceNetworkEvents
| where Timestamp > ago(1d)
| where ActionType == 'ConnectionSuccess'
| extend Domain = tostring(parse_url(RemoteUrl).Host)
| where Domain in (llmDomains)
| summarize TodayCount = count(), Domains = make_set(Domain, 20) by InitiatingProcessAccountUpn
| join kind=inner baseline on InitiatingProcessAccountUpn
| extend Threshold = AvgDaily + (3 * StdDevDaily)
| where TodayCount > Threshold and TodayCount > 20
| extend AnomalyScore = round((TodayCount - AvgDaily) / iff(StdDevDaily == 0, 1.0, StdDevDaily), 2)
| project InitiatingProcessAccountUpn, TodayCount, AvgDaily = round(AvgDaily, 1), StdDevDaily = round(StdDevDaily, 1), Threshold = round(Threshold, 1), AnomalyScore, Domains
| order by AnomalyScore desc How it works
Calculates a per-user 14-day baseline of daily connection counts to consumer LLM domains, then flags users whose current-day count exceeds the baseline mean plus three standard deviations. The minimum threshold of 20 connections prevents alerting on users with very low baselines. The anomaly score quantifies how far above normal the usage is. Spikes may indicate a user beginning bulk data migration to an AI tool, automated scripting against an AI API, or a new team adopting an AI service without authorization.
Required data sources
- Microsoft Defender for Endpoint (DeviceNetworkEvents)
- Sentinel watchlist: ConsumerLLMDomains
Prerequisites
- Microsoft 365 E5 or Defender for Endpoint P2
- Sentinel workspace with M365D connector
- At least 14 days of historical DeviceNetworkEvents data for baseline
- Watchlist created from /watchlists/ConsumerLLMDomains.csv
Expected volume
Low — 2-10 anomaly alerts per day for an org of 10k users. Most will be legitimate behavior changes (e.g., user starts a new project leveraging AI heavily). Investigate users with AnomalyScore > 5.
False-positive guidance
Common FP: (1) users returning from vacation with compressed work patterns, (2) users in approved AI pilot programs who ramp up usage, (3) browser tabs auto-refreshing AI service pages generating passive connections. Correlate with DET-MS-SEN-005 (data volume) to distinguish browsing from data transfer.
Tuning steps
- Adjust the standard-deviation multiplier (default 3) based on organizational tolerance — lower for stricter detection.
- Increase the minimum TodayCount threshold above 20 if baseline noise is high.
- Exclude users in approved AI pilot groups from anomaly alerting.
- Correlate with DET-MS-SEN-005 to prioritize spikes that also involve large data volumes.
Framework mappings
- NIST AI RMF: GOVERN-4.1, MEASURE-2.7
- ISO/IEC 42001: 8.2, 8.3
- NIST CSF: DE.AE-1, DE.CM-1