GCP Vertex AI High Request and Token Volume

  1[metadata]
  2creation_date = "2026/10/02"
  3integration = ["gcp_vertexai"]
  4maturity = "production"
  5min_stack_comments = "gcp_vertexai prompt_response_logs requires integration 1.4.0+ (Kibana ^9.2.0)."
  6min_stack_version = "9.3.0"
  7updated_date = "2026/10/07"
  8
  9[rule]
 10author = ["Elastic"]
 11description = """
 12Detects a high number of Vertex AI prompt-response log rows and high total token usage for one model in the
 13lookback window. Totals use provider usage_metadata.total_token_count (includes thinking tokens when billed). High
 14request and token volume can indicate model extraction, quota abuse, or a compromised caller. Tune thresholds for your
 15baseline.
 16"""
 17false_positives = [
 18    """
 19    Approved batch evaluation or high-traffic applications. Raise thresholds above the normal peak per model.
 20    """,
 21]
 22from = "now-60m"
 23interval = "10m"
 24language = "esql"
 25license = "Elastic License v2"
 26name = "GCP Vertex AI High Request and Token Volume"
 27note = """## Triage and analysis
 28
 29### Investigating GCP Vertex AI High Request and Token Volume
 30
 31One model exceeded both the request-count and total-token thresholds in the lookback window.
 32`Esql.total_tokens_sum` comes from `usage_metadata.total_token_count`, which includes thinking tokens
 33when the provider reports them. High volume can indicate model extraction, quota abuse, cost impact,
 34or a compromised caller. This rule aggregates usage metadata; individual prompt text is not required
 35on the alert.
 36
 37#### Possible investigation steps
 38
 39- Note `gcp.vertexai.prompt_response_logs.model`, `cloud.project.id`, `Esql.event_count`,
 40  `Esql.prompt_tokens_sum`, `Esql.candidates_tokens_sum`, and `Esql.total_tokens_sum`.
 41- Compare request count vs token sums: many short calls (scraping/extraction) vs fewer huge prompts
 42  (context stuffing / data exfil via prompt). When `Esql.total_tokens_sum` is much larger than
 43  prompt+candidates, thinking tokens may dominate usage.
 44- Pivot to `logs-gcp_vertexai.auditlogs-*` GenerateContent for `source.ip` and `client.user.email`
 45  concentration in the same window.
 46- Sample `prompt_response_logs` for that model/time range to see whether content looks like
 47  systematic extraction.
 48- Check for recent `SetPublisherModelConfig` changes that might have altered logging visibility.
 49
 50### False positive analysis
 51
 52- Approved batch evaluation, fine-tuning data prep, or high-traffic production apps. Raise
 53  `Esql.event_count` and token thresholds above the normal peak per model before broad enablement.
 54
 55### Response and remediation
 56
 57- Restrict or rotate caller credentials, apply quotas, and review spend/billing for the model.
 58- If compromise is suspected, hunt lateral use of the same principal across other GCP services.
 59"""
 60references = [
 61    "https://www.elastic.co/docs/reference/integrations/gcp_vertexai",
 62]
 63risk_score = 47
 64rule_id = "9bd7c550-5d7f-43ed-969a-76eb50f9e553"
 65setup = """## Setup
 66
 67Requires GCP Vertex AI `prompt_response_logs` with usage_metadata token counts. Raise `Esql.event_count` and token
 68thresholds above your normal peak before broad enablement.
 69"""
 70severity = "medium"
 71tags = [
 72    "Domain: GenAI",
 73    "Domain: Cloud",
 74    "Data Source: GCP Vertex AI",
 75    "Data Source: GCP",
 76    "Data Source: Google Cloud Platform",
 77    "Platform: GCP",
 78    "Service: GCP Vertex AI",
 79    "Use Case: Potential Overload",
 80    "Use Case: Threat Detection",
 81    "Tactic: Impact",
 82    "Threat: LLMjacking",
 83    "Threat: Unauthorized AI Usage",
 84    "Mitre Atlas: AML.T0029",
 85    "Mitre Atlas: AML.T0034",
 86    "Resources: Investigation Guide",
 87    "Rule Type: ES|QL",
 88]
 89timestamp_override = "event.ingested"
 90type = "esql"
 91
 92query = '''
 93from logs-gcp_vertexai.prompt_response_logs-*
 94| where
 95    data_stream.dataset == "gcp_vertexai.prompt_response_logs" and
 96    gcp.vertexai.prompt_response_logs.full_response.usage_metadata.prompt_token_count > 0
 97| stats
 98    Esql.event_count = count(*),
 99    Esql.prompt_tokens_sum = sum(gcp.vertexai.prompt_response_logs.full_response.usage_metadata.prompt_token_count),
100    Esql.candidates_tokens_sum = sum(gcp.vertexai.prompt_response_logs.full_response.usage_metadata.candidates_token_count),
101    Esql.total_tokens_sum = sum(gcp.vertexai.prompt_response_logs.full_response.usage_metadata.total_token_count),
102    Esql.timestamp_first_seen = min(@timestamp),
103    Esql.timestamp_last_seen = max(@timestamp)
104  by
105    gcp.vertexai.prompt_response_logs.model,
106    cloud.project.id
107| where Esql.event_count >= 100 and Esql.total_tokens_sum >= 10000
108| keep
109    gcp.vertexai.prompt_response_logs.model,
110    cloud.project.id,
111    Esql.event_count,
112    Esql.prompt_tokens_sum,
113    Esql.candidates_tokens_sum,
114    Esql.total_tokens_sum,
115    Esql.timestamp_first_seen,
116    Esql.timestamp_last_seen
117'''
118
119
120[[rule.threat]]
121framework = "MITRE ATT&CK"
122[[rule.threat.technique]]
123id = "T1496"
124name = "Resource Hijacking"
125reference = "https://attack.mitre.org/techniques/T1496/"
126
127
128[rule.threat.tactic]
129id = "TA0040"
130name = "Impact"
131reference = "https://attack.mitre.org/tactics/TA0040/"
132[[rule.threat_mappings]]
133framework = "MITRE ATLAS"
134version = "2026.08"
135[[rule.threat_mappings.threat]]
136framework = "MITRE ATLAS"
137[[rule.threat_mappings.threat.technique]]
138id = "AML.T0029"
139name = "Denial of AI Service"
140reference = "https://atlas.mitre.org/techniques/AML.T0029/"
141
142
143[rule.threat_mappings.threat.tactic]
144id = "AML.TA0011"
145name = "Impact"
146reference = "https://atlas.mitre.org/tactics/AML.TA0011/"
147[[rule.threat_mappings.threat]]
148framework = "MITRE ATLAS"
149[[rule.threat_mappings.threat.technique]]
150id = "AML.T0034"
151name = "Cost Harvesting"
152reference = "https://atlas.mitre.org/techniques/AML.T0034/"
153
154
155[rule.threat_mappings.threat.tactic]
156id = "AML.TA0011"
157name = "Impact"
158reference = "https://atlas.mitre.org/tactics/AML.TA0011/"
159
160[rule.alert_suppression]
161group_by = ["gcp.vertexai.prompt_response_logs.model", "cloud.project.id"]
162missing_fields_strategy = "suppress"
163
164[rule.investigation_fields]
165field_names = [
166    "gcp.vertexai.prompt_response_logs.model",
167    "cloud.project.id",
168    "Esql.event_count",
169    "Esql.prompt_tokens_sum",
170    "Esql.candidates_tokens_sum",
171    "Esql.total_tokens_sum",
172    "Esql.timestamp_first_seen",
173    "Esql.timestamp_last_seen",
174]
175
176[rule.alert_suppression.duration]
177unit = "h"
178value = 1