AWS Bedrock Unusual Tool Selection

  1[metadata]
  2creation_date = "2026/10/23"
  3integration = ["security_ai", "aws_bedrock"]
  4maturity = "production"
  5min_stack_comments = "Detection rules for the security_ai integration package are supported in v9.6.0 and above"
  6min_stack_version = "9.6.0"
  7updated_date = "2026/11/06"
  8
  9[rule]
 10anomaly_threshold = 50
 11author = ["Elastic"]
 12description = """
 13A machine learning job has detected that an Amazon Bedrock model requested a tool that is rare for a caller, compared
 14with that caller's own history. A model that suddenly selects an unfamiliar tool can indicate that an AI agent was redirected
 15toward an unexpected capability, for example through prompt injection or unsafe delegation (OWASP ASI02, Tool Misuse and
 16Exploitation). The tool name is a requested operation in the model output, not a confirmed tool execution.
 17"""
 18false_positives = [
 19    """
 20    A newly deployed or newly enabled tool is rare by definition until it has been used regularly. Confirm any recent change to the agent's tool set.
 21    """,
 22    """
 23    Seasonal or rarely used legitimate tools, such as monthly reporting or maintenance tools, can appear unusual when they are used.
 24    """,
 25]
 26from = "now-60m"
 27interval = "15m"
 28license = "Elastic License v2"
 29machine_learning_job_id = "security_ai_bedrock_asi02_rare_tool"
 30name = "AWS Bedrock Unusual Tool Selection"
 31note = """
 32## Triage and Analysis
 33
 34### Investigating AWS Bedrock Unusual Tool Selection
 35
 36This alert means that a tool name in the model output was rare for the caller. The ML job uses the `rare` function by `tool_name`, partitioned by `user.id`, on a datafeed that aggregates each requested tool name separately per one-hour bucket.
 37
 38### Limitations
 39
 40- The anomaly threshold is an ML record score from 0 to 100, not a tool-request count. It is set to 1 to keep recall as high as possible, because alerts were validated on a small synthetic workload from a single caller.
 41- Baselines are per caller (`user.id`). For AWS ARNs, the account ID is part of the identifier. For an assumed role, user.id ends with a session name that can change with every session or invocation (AgentCore does), so each distinct session name gets its own baseline and starts with no history. IAM users are not affected. A stable user.name (the role name) is planned for a later aws_bedrock release (2.4.0). A job that partitioned by it would give all sessions of one role a shared baseline, and roles with the same name in different accounts would share one too. Runtimes or agents that share an IAM user share one baseline. Bedrock invocation events carry no runtime ARN, so per-agent detection is not possible with this telemetry.
 42- The values are tool requests generated by the model, not confirmed tool executions. An alert does not establish malicious intent or an authorization violation.
 43- Machine learning learns repeated anomalies, so scores fade when the same behavior recurs. Persistent known-bad cases need a deterministic rule.
 44- Misuse of a familiar tool with harmful arguments at normal volume and batch size can evade this detection.
 45
 46### Possible investigation steps
 47
 48- Open the anomaly in Anomaly Explorer for job `security_ai_bedrock_asi02_rare_tool` and note the unusual `tool_name` and the `user.id` partition.
 49- Search `logs-aws_bedrock.invocation-*` for responses where `gen_ai.output.messages.content.toolUse.name` equals the unusual tool in the bucket time range. Use `aws_bedrock.invocation.request_id` to pivot to the full record.
 50- Identify the caller from `user.id` and `cloud.account.id`, and confirm whether the tool is part of the agent's configured tool set.
 51- Determine what the tool can do (read, write, delete, send, or execute) and what data or systems it can reach.
 52- Review the input messages and the `security_ai` results on the same document, such as instruction-override, encoding, or refusal detections, for signs of prompt injection.
 53- Check CloudTrail and the tool or API logs of the agent to determine whether the tool was executed.
 54
 55### False positive analysis
 56
 57- A newly released tool or a changed agent configuration makes a tool appear unusual. After confirming the change, no action is needed, and the model learns the tool as normal over time.
 58- Rarely used maintenance or reporting tools can alert whenever they run. Consider a scoped exception if the use is routine.
 59
 60### Response and remediation
 61
 62- If the tool selection is unexpected, restrict the tool or the agent's permissions, and review the conversation that led to it.
 63- Treat the source of the prompt as untrusted if prompt injection is suspected, and block or sanitize it.
 64- If the tool was executed, assess the impact on the data and systems it can reach, and rotate any exposed credentials.
 65- Maintain an allowlist or denylist as a deterministic rule for tools that must never be used. ML rarity is not a reliable control for known-bad tools.
 66"""
 67references = [
 68    "https://genai.owasp.org/",
 69    "https://docs.elastic.co/en/integrations/aws_bedrock",
 70]
 71risk_score = 47
 72rule_id = "2aad4e1b-85d9-4200-ab3d-949675fdc183"
 73setup = """
 74## Setup
 75
 76This rule requires the Security for AI integration assets, the Amazon Bedrock integration, and AWS Bedrock model invocation logs.
 77
 78### Prerequisite Requirements
 79- Install the Amazon Bedrock integration and collect the `invocation` data stream (`logs-aws_bedrock.invocation-*`). The `runtime` and `guardrails` data streams are not used.
 80- Enable AWS Bedrock model invocation logging, delivered to S3 or CloudWatch Logs, with credentials for the Elastic Agent that can read that destination.
 81- Confirm the tool-use fields are indexed: `gen_ai.output.messages.content.toolUse.toolUseId`, `gen_ai.output.messages.content.toolUse.name`, `gen_ai.output.messages.role`, `gen_ai.response.finish_reasons`, `user.id`, `aws_bedrock.invocation.request_id`, and `cloud.account.id`. Only successful `Converse` and `ConverseStream` invocations are analyzed.
 82
 83### Anomaly Detection Setup
 84- Install the [Security for AI integration](https://www.elastic.co/docs/reference/integrations/security_ai), then install its Kibana assets. This loads the `security_ai-ml` machine learning module.
 85- Create the `security_ai_bedrock_asi02_rare_tool` anomaly detection job from that module, or enable this rule so that the job is started for you. The job and its datafeed read the index pattern you select when you create the job (`logs-aws_bedrock.invocation-*`) directly. The datafeed derives the tool-request metrics at search time and reads user.id as indexed. No transform or extra index is required.
 86- Anomaly detection learns each caller's normal behavior from its own telemetry, so the job needs time to learn before its results are reliable.
 87- For more details, refer to the [anomaly detection documentation](https://www.elastic.co/guide/en/kibana/current/xpack-ml-anomalies.html).
 88"""
 89severity = "medium"
 90tags = [
 91    "Domain: GenAI",
 92    "Data Source: AWS Bedrock",
 93    "Platform: AWS",
 94    "Service: AWS Bedrock",
 95    "Use Case: Security for AI",
 96    "Rule Type: Machine Learning",
 97    "Rule Type: ML",
 98    "Resources: Investigation Guide",
 99    "Tactic: Execution",
100    "Mitre Atlas: AML.T0053",
101]
102type = "machine_learning"
103
104[[rule.threat_mappings]]
105framework = "MITRE ATLAS"
106version = "2026.08"
107
108[[rule.threat_mappings.threat]]
109framework = "MITRE ATLAS"
110
111[[rule.threat_mappings.threat.technique]]
112id = "AML.T0053"
113name = "AI Agent Tool Invocation"
114reference = "https://atlas.mitre.org/techniques/AML.T0053/"
115
116[rule.threat_mappings.threat.tactic]
117id = "AML.TA0005"
118name = "Execution"
119reference = "https://atlas.mitre.org/tactics/AML.TA0005/"