AWS Bedrock Unusually Large Tool-Request Batch

  1[metadata]
  2creation_date = "2026/10/23"
  3integration = ["security_ai", "aws_bedrock"]
  4maturity = "production"
  5min_stack_comments = "Detection rules for the security_ai integration package are supported in v9.6.0 and above"
  6min_stack_version = "9.6.0"
  7updated_date = "2026/11/06"
  8
  9[rule]
 10anomaly_threshold = 50
 11author = ["Elastic"]
 12description = """
 13A machine learning job has detected an unusually large number of tool requests generated in a single Amazon Bedrock model
 14response for a caller, compared with that caller's own history. Large batches can indicate over-invocation of tools by
 15an AI agent, for example after prompt injection, ambiguous instructions, or unsafe delegation (OWASP ASI02, Tool Misuse and
 16Exploitation). The count is requested operations in the model output, not confirmed tool executions.
 17"""
 18false_positives = [
 19    """
 20    A legitimate change in agent behavior, such as a new workflow, a bulk-processing task, or a prompt update that asks the model to call
 21    many tools in one turn, can produce a larger batch than the caller's history. Confirm with the agent owner.
 22    """,
 23    """
 24    A newly onboarded caller has little history, so early batches can look unusual until the model has learned its normal range.
 25    """,
 26]
 27from = "now-60m"
 28interval = "15m"
 29license = "Elastic License v2"
 30machine_learning_job_id = "security_ai_bedrock_asi02_large_tool_batch"
 31name = "AWS Bedrock Unusually Large Tool-Request Batch"
 32note = """
 33## Triage and Analysis
 34
 35### Investigating AWS Bedrock Unusually Large Tool-Request Batch
 36
 37This alert means that the largest number of tool requests (tool-use IDs) in one assistant response during a 15-minute bucket was unusually high for the caller. The ML job uses `max` of the per-response tool-request count, partitioned by `user.id`.
 38
 39### Limitations
 40
 41- The anomaly threshold is an ML record score from 0 to 100, not a tool-request count. It is set to 1 to keep recall as high as possible, because alerts were validated on a small synthetic workload from a single caller.
 42- Baselines are per caller (`user.id`). For AWS ARNs, the account ID is part of the identifier. For an assumed role, user.id ends with a session name that can change with every session or invocation (AgentCore does), so each distinct session name gets its own baseline and starts with no history. IAM users are not affected. A stable user.name (the role name) is planned for a later aws_bedrock release (2.4.0). A job that partitioned by it would give all sessions of one role a shared baseline, and roles with the same name in different accounts would share one too. Runtimes or agents that share an IAM user share one baseline. Bedrock invocation events carry no runtime ARN, so per-agent detection is not possible with this telemetry.
 43- The values are tool requests generated by the model, not confirmed tool executions. An alert does not establish malicious intent or an authorization violation.
 44- Machine learning learns repeated anomalies, so scores fade when the same behavior recurs. Persistent known-bad cases need a deterministic rule.
 45- Misuse of a familiar tool with harmful arguments at normal volume and batch size can evade this detection.
 46
 47### Possible investigation steps
 48
 49- Open the anomaly in Anomaly Explorer for job `security_ai_bedrock_asi02_large_tool_batch` and note the actual versus typical batch size and the `user.id` partition.
 50- Identify the caller. `user.id` identifies the caller (an assumed-role ARN without its session name, or an IAM user ARN). Check `user.id` and `cloud.account.id` in `logs-aws_bedrock.invocation-*` for the bucket time range.
 51- Find the responses with the most tool requests: filter `data_stream.dataset: "aws_bedrock.invocation"` and `event.action: ("Converse" or "ConverseStream")`, then sort by the number of values in `gen_ai.output.messages.content.toolUse.toolUseId`. Use `aws_bedrock.invocation.request_id` to pivot to the full record.
 52- Review `gen_ai.output.messages.content.toolUse.name` to see which tools were requested and whether they are destructive, expensive, or sensitive.
 53- Review the input messages and the `security_ai` results on the same document, such as instruction-override or encoding detections, for signs of prompt injection.
 54- Check CloudTrail and the tool or API logs of the agent to determine whether the requested operations were executed.
 55
 56### False positive analysis
 57
 58- Batch jobs, bulk processing, or fan-out workflows legitimately request many tools in one turn. Document the workload and, if it is routine, raise the rule threshold or add a scoped exception for the caller.
 59- Release of a new prompt or tool set changes batch sizes. Re-check after the model has learned the new normal.
 60
 61### Response and remediation
 62
 63- If the batch is unexpected, review and, if needed, restrict the permissions of the agent's execution role and its tool integrations.
 64- Add a per-response tool-call limit in the agent framework, and consider a deterministic detection rule for a fixed ceiling.
 65- Rotate any credentials the tools could access if prompt injection is suspected, and review the conversation source.
 66- Escalate to the owner of the agent and the AI security team.
 67"""
 68references = [
 69    "https://genai.owasp.org/",
 70    "https://docs.elastic.co/en/integrations/aws_bedrock",
 71]
 72risk_score = 47
 73rule_id = "08a00802-7b17-4160-96d0-4bb8d4abbfb6"
 74setup = """
 75## Setup
 76
 77This rule requires the Security for AI integration assets, the Amazon Bedrock integration, and AWS Bedrock model invocation logs.
 78
 79### Prerequisite Requirements
 80- Install the Amazon Bedrock integration and collect the `invocation` data stream (`logs-aws_bedrock.invocation-*`). The `runtime` and `guardrails` data streams are not used.
 81- Enable AWS Bedrock model invocation logging, delivered to S3 or CloudWatch Logs, with credentials for the Elastic Agent that can read that destination.
 82- Confirm the tool-use fields are indexed: `gen_ai.output.messages.content.toolUse.toolUseId`, `gen_ai.output.messages.content.toolUse.name`, `gen_ai.output.messages.role`, `gen_ai.response.finish_reasons`, `user.id`, `aws_bedrock.invocation.request_id`, and `cloud.account.id`. Only successful `Converse` and `ConverseStream` invocations are analyzed.
 83
 84### Anomaly Detection Setup
 85- Install the [Security for AI integration](https://www.elastic.co/docs/reference/integrations/security_ai), then install its Kibana assets. This loads the `security_ai-ml` machine learning module.
 86- Create the `security_ai_bedrock_asi02_large_tool_batch` anomaly detection job from that module, or enable this rule so that the job is started for you. The job and its datafeed read the index pattern you select when you create the job (`logs-aws_bedrock.invocation-*`) directly. The datafeed derives the tool-request metrics at search time and reads user.id as indexed. No transform or extra index is required.
 87- Anomaly detection learns each caller's normal behavior from its own telemetry, so the job needs time to learn before its results are reliable.
 88- For more details, refer to the [anomaly detection documentation](https://www.elastic.co/guide/en/kibana/current/xpack-ml-anomalies.html).
 89"""
 90severity = "medium"
 91tags = [
 92    "Domain: GenAI",
 93    "Data Source: AWS Bedrock",
 94    "Platform: AWS",
 95    "Service: AWS Bedrock",
 96    "Use Case: Security for AI",
 97    "Rule Type: Machine Learning",
 98    "Rule Type: ML",
 99    "Resources: Investigation Guide",
100    "Tactic: Execution",
101    "Mitre Atlas: AML.T0053",
102]
103type = "machine_learning"
104
105[[rule.threat_mappings]]
106framework = "MITRE ATLAS"
107version = "2026.08"
108
109[[rule.threat_mappings.threat]]
110framework = "MITRE ATLAS"
111
112[[rule.threat_mappings.threat.technique]]
113id = "AML.T0053"
114name = "AI Agent Tool Invocation"
115reference = "https://atlas.mitre.org/techniques/AML.T0053/"
116
117[rule.threat_mappings.threat.tactic]
118id = "AML.TA0005"
119name = "Execution"
120reference = "https://atlas.mitre.org/tactics/AML.TA0005/"