Microsoft 365 Copilot interaction flagged as indirect attack
이 페이지는 아직 한국어로 제공되지 않습니다. 번역 작업 중입니다.
현재 번역 프로젝트에 대한 질문이나 피드백이 있으신 경우
언제든지 연락주시기 바랍니다.Goal
Detect when an M365 Copilot Studio bot experiences an indirect attack as defined by Microsoft’s content safety checks.
The Microsoft generated alert attempts identify if an actor embeds instructions to the agent for the purpose of maliciously gaining access to unauthorized data or control of the system.
Strategy
Monitor Microsoft 365 audit logs for when the @CopilotEventData.AccessedResources.Type includes an IndirectAttack flag within the Copilot service logs.
Triage and response
- Identify what user,
{{@usr.id}}, and action triggered the Microsoft content safety alert. The @CopilotEventData.AccessedResources.Name includes the user action which generated the IndirectAttack alert. - Determine if the user
{{@usr.id}} and the action taken represents malicious behavior for your organization’s bot. - If the interaction prompted the bot for unauthorized access or attempted to manipulate the bot, investigate surrounding events for anomalous activity. If necessary, initiate your company’s incident response (IR) process.
