---
title: Azure AI Foundry RAI (content filter) policy modified
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > Azure AI Foundry RAI (content filter)
  policy modified
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Azure AI Foundry RAI (content filter) policy modified
Classification:attackTactic:[TA0005-defense-evasion](https://attack.mitre.org/tactics/TA0005)Technique:[T1562-impair-defenses](https://attack.mitre.org/techniques/T1562) 
## Goal{% #goal %}

Detects modification of an Azure AI Foundry Responsible AI (RAI) content-filter policy.

## Strategy{% #strategy %}

This rule monitors Azure Activity Log events where `@evt.name` is `MICROSOFT.COGNITIVESERVICES/ACCOUNTS/RAIPOLICIES/WRITE` and `@evt.outcome` is `Success`. This may indicate that LLM guardrails such as content filters and prompt injection protections were weakened for an LLM deployment.

## Triage & Response{% #triage--response %}

- Examine the `resourceId` and `properties.entity` fields on the triggering event to identify which Cognitive Services account and RAI policy `{{@usr.id}}` modified.
- Review the specific policy change by comparing the modified policy's content-filter categories and severity thresholds against the account's baseline configuration.
- Verify if `{{@usr.id}}` has a legitimate business reason to modify RAI policies for this account, such as a documented content-filter tuning request.
- Check whether the modification loosened restrictions, such as raising severity thresholds or removing blocked categories.
- Identify any subsequent inference requests against the affected deployments and account shortly after the policy change to assess whether the modification was followed by suspicious model usage.