Azure AI Foundry RAI (content filter) policy modified
このページは日本語には対応しておりません。随時翻訳に取り組んでいます。
翻訳に関してご質問やご意見ございましたら、
お気軽にご連絡ください。
Goal
Detects modification of an Azure AI Foundry Responsible AI (RAI) content-filter policy.
Strategy
This rule monitors Azure Activity Log events where @evt.name is MICROSOFT.COGNITIVESERVICES/ACCOUNTS/RAIPOLICIES/WRITE and @evt.outcome is Success. This may indicate that LLM guardrails such as content filters and prompt injection protections were weakened for an LLM deployment.
Triage & Response
- Examine the
resourceId and properties.entity fields on the triggering event to identify which Cognitive Services account and RAI policy {{@usr.id}} modified. - Review the specific policy change by comparing the modified policy’s content-filter categories and severity thresholds against the account’s baseline configuration.
- Verify if
{{@usr.id}} has a legitimate business reason to modify RAI policies for this account, such as a documented content-filter tuning request. - Check whether the modification loosened restrictions, such as raising severity thresholds or removing blocked categories.
- Identify any subsequent inference requests against the affected deployments and account shortly after the policy change to assess whether the modification was followed by suspicious model usage.
