Microsoft Foundry Jailbreak Detected

  1[metadata]
  2creation_date = "2026/10/01"
  3integration = ["azure_ai_foundry"]
  4maturity = "production"
  5min_stack_version = "9.3.0"
  6min_stack_comments = "The Microsoft Foundry integration is compatible with 9.3 and above."
  7updated_date = "2026/10/05"
  8
  9[rule]
 10author = ["Elastic"]
 11description = """
 12Detects a Microsoft Foundry chat, sent through API Management, where Azure sets jailbreak.detected on the prompt.
 13The flag is on the prompt filter when the call is allowed through, and on the error body when the filter blocks the
 14call.
 15"""
 16false_positives = [
 17    """
 18    Approved prompt-security tests that send known jailbreak strings, such as DAN or "ignore previous instructions".
 19    Exclude that source IP or API Management subscription.
 20    """,
 21]
 22from = "now-9m"
 23language = "esql"
 24license = "Elastic License v2"
 25name = "Microsoft Foundry Jailbreak Detected"
 26note = """## Triage and analysis
 27
 28### Investigating Microsoft Foundry Jailbreak Detected
 29
 30Foundry marked the prompt as a jailbreak. On a blocked call the flag is
 31error.innererror.content_filter_result.jailbreak.detected and the backend response code is 400. On a call that was
 32allowed through, the flag is prompt_filter_results.content_filter_results.jailbreak.detected and the response code
 33is 200. A 200 with the flag set means the filter annotated the prompt and still sent it to the model.
 34
 35#### Possible investigation steps
 36
 37- Read the prompt on the alert. Confirm it is an instruction to ignore or override the model's rules.
 38- Check backend_response_code. 400 means the filter blocked the call. 200 means the prompt was annotated and the
 39  model still answered. Read the assistant reply on a 200.
 40- Identify the caller from source.ip, user agent, and apim_subscription_id, and the target from the model and URL path.
 41- Look for other GatewayLogs from the same IP or subscription in the same window, including repeated refusals.
 42
 43### False positive analysis
 44
 45- Red-team and application tests that deliberately send jailbreak prompts. Exclude that source IP or subscription.
 46
 47### Response and remediation
 48
 49- If the caller is not approved, disable or rotate the API Management subscription key and block the source IP.
 50- On a 200, review the assistant reply for a bypassed instruction, and tighten the content filter from annotate to
 51  block if this deployment should refuse jailbreak prompts.
 52"""
 53references = [
 54    "https://www.elastic.co/docs/reference/integrations/azure_ai_foundry",
 55    "https://learn.microsoft.com/en-us/azure/ai-services/openai/concepts/content-filter",
 56]
 57risk_score = 47
 58rule_id = "a8eadd55-e6da-4df6-becd-910cd0da19f7"
 59setup = """## Setup
 60
 61This rule needs the Microsoft Foundry integration collecting Azure API Management GatewayLogs with the backend
 62response body. jailbreak.detected is inside that body. Log the request body as well so the prompt is on the alert.
 63Foundry RequestResponse logs do not carry this flag.
 64
 65- Use an API Management tier that emits resource logs. Developer or higher works. Consumption does not.
 66- Send the GatewayLogs category to the Event Hub the integration reads.
 67- Log the backend response body in API diagnostics. Log the request body to keep the prompt for triage.
 68
 69https://www.elastic.co/docs/reference/integrations/azure_ai_foundry
 70"""
 71severity = "medium"
 72tags = [
 73    "Data Source: Microsoft Foundry",
 74    "Use Case: Threat Detection",
 75    "Mitre Atlas: AML.T0051",
 76    "Mitre Atlas: AML.T0054",
 77    "Tactic: Defense Evasion",
 78    "Resources: Investigation Guide",
 79    "Rule Type: ES|QL",
 80    "Platform: Azure",
 81    "Domain: Cloud",
 82    "Domain: GenAI",
 83    "Service: Azure API Management",
 84]
 85timestamp_override = "event.ingested"
 86type = "esql"
 87
 88query = '''
 89from logs-azure_ai_foundry.logs-* metadata _id, _version, _index
 90| where
 91    data_stream.dataset == "azure_ai_foundry.logs" and
 92    azure.ai_foundry.category == "GatewayLogs" and
 93    (
 94        azure.ai_foundry.properties.backend_response_body.prompt_filter_results.content_filter_results.jailbreak.detected == true or
 95        azure.ai_foundry.properties.backend_response_body.error.innererror.content_filter_result.jailbreak.detected == true or
 96        azure.ai_foundry.properties.backend_response_body.choices.content_filter_results.jailbreak.detected == true
 97    )
 98| keep
 99    _id,
100    _version,
101    _index,
102    @timestamp,
103    source.ip,
104    azure.ai_foundry.properties.user_agent,
105    azure.ai_foundry.properties.apim_subscription_id,
106    azure.ai_foundry.properties.api_id,
107    azure.ai_foundry.properties.operation_id,
108    azure.ai_foundry.properties.backend_response_body.model,
109    azure.ai_foundry.properties.backend_response_code,
110    azure.ai_foundry.service_name,
111    azure.resource.group,
112    url.domain,
113    url.path,
114    source.geo.country_iso_code,
115    source.geo.city_name,
116    source.as.organization.name,
117    azure.ai_foundry.properties.backend_request_body.messages.content,
118    azure.ai_foundry.properties.backend_response_body.choices.message.content,
119    azure.ai_foundry.properties.backend_response_body.prompt_filter_results.content_filter_results.jailbreak.detected,
120    azure.ai_foundry.properties.backend_response_body.error.innererror.content_filter_result.jailbreak.detected,
121    azure.ai_foundry.properties.backend_response_body.choices.content_filter_results.jailbreak.detected
122'''
123
124
125[[rule.threat]]
126framework = "MITRE ATT&CK"
127[[rule.threat.technique]]
128id = "T1562"
129name = "Impair Defenses"
130reference = "https://attack.mitre.org/techniques/T1562/"
131
132
133[rule.threat.tactic]
134id = "TA0005"
135name = "Defense Evasion"
136reference = "https://attack.mitre.org/tactics/TA0005/"
137
138[[rule.threat_mappings]]
139framework = "MITRE ATLAS"
140version = "2026.08"
141[[rule.threat_mappings.threat]]
142framework = "MITRE ATLAS"
143[[rule.threat_mappings.threat.technique]]
144id = "AML.T0051"
145name = "LLM Prompt Injection"
146reference = "https://atlas.mitre.org/techniques/AML.T0051/"
147
148
149[rule.threat_mappings.threat.tactic]
150id = "AML.TA0005"
151name = "Execution"
152reference = "https://atlas.mitre.org/tactics/AML.TA0005/"
153[[rule.threat_mappings.threat]]
154framework = "MITRE ATLAS"
155[[rule.threat_mappings.threat.technique]]
156id = "AML.T0054"
157name = "LLM Jailbreak"
158reference = "https://atlas.mitre.org/techniques/AML.T0054/"
159
160
161[rule.threat_mappings.threat.tactic]
162id = "AML.TA0007"
163name = "Defense Evasion"
164reference = "https://atlas.mitre.org/tactics/AML.TA0007/"
165
166[rule.investigation_fields]
167field_names = [
168    "source.ip",
169    "azure.ai_foundry.properties.user_agent",
170    "azure.ai_foundry.properties.apim_subscription_id",
171    "azure.ai_foundry.properties.api_id",
172    "azure.ai_foundry.properties.operation_id",
173    "azure.ai_foundry.properties.backend_response_body.model",
174    "azure.ai_foundry.properties.backend_response_code",
175    "azure.ai_foundry.service_name",
176    "azure.resource.group",
177    "url.domain",
178    "url.path",
179    "source.geo.country_iso_code",
180    "source.geo.city_name",
181    "source.as.organization.name",
182    "azure.ai_foundry.properties.backend_request_body.messages.content",
183    "azure.ai_foundry.properties.backend_response_body.choices.message.content",
184    "azure.ai_foundry.properties.backend_response_body.prompt_filter_results.content_filter_results.jailbreak.detected",
185    "azure.ai_foundry.properties.backend_response_body.error.innererror.content_filter_result.jailbreak.detected",
186    "azure.ai_foundry.properties.backend_response_body.choices.content_filter_results.jailbreak.detected",
187]