-
GCP Vertex AI High Request and Token Volume
Oct 7, 2026 · Domain: GenAI Domain: Cloud Data Source: GCP Vertex AI Data Source: GCP Data Source: Google Cloud Platform Platform: GCP Service: GCP Vertex AI Use Case: Potential Overload Use Case: Threat Detection Tactic: Impact Threat: LLMjacking Threat: Unauthorized AI Usage Mitre Atlas: AML.T0029 Mitre Atlas: AML.T0034 Resources: Investigation Guide Rule Type: ES|QL ·Detects a high number of Vertex AI prompt-response log rows and high total token usage for one model in the lookback window. Totals use provider usage_metadata.total_token_count (includes thinking tokens when billed). High request and token volume can indicate model extraction, quota abuse, or a compromised caller. Tune thresholds for your baseline.
Read More -
Potential Abuse of Resources by High Token Count and Large Response Sizes
Oct 1, 2026 · Domain: GenAI Data Source: AWS Bedrock Data Source: Amazon Web Services Data Source: AWS S3 Use Case: Potential Overload Use Case: Resource Exhaustion Resources: Investigation Guide Noise: Low Performance: Normal Rule Type: ES|QL Platform: AWS Domain: Cloud Service: AWS S3 Service: AWS Bedrock Mitre Atlas: AML.T0029 Mitre Atlas: AML.T0034 ·Detects potential resource exhaustion or data breach attempts by monitoring for users who consistently generate high input token counts, submit numerous requests, and receive large responses. This behavior could indicate an attempt to overload the system or extract an unusually large amount of data, possibly revealing sensitive information or causing service disruptions.
Read More