major_audit_agent

The Major AI Activity Audit Reporter is a security analyst agent that specializes in AI activity auditing and integrates with Microsoft Sentinel to retrieve and analyze AI agent invocation data. The agent works with Sentinel's Log Analytics workspace to access the table, executing a coordinated series of KQL queries to identify usage anomalies, security concerns, and behavioral patterns in AI agent activities across the organization.

Agent Tasks:

• Execute six coordinated KQL audits:
1. Activity summary by user (total invocations, applications used, resource types accessed, failure counts)
2. Week-over-week volume trending to identify usage spikes
3. First-time resource type access detection (comparative analysis against historical baseline)
4. High-frequency burst activity detection (hourly activity patterns and anomalies)
5. SQL query pattern tracking and flagging (identifies database queries and sensitive operations)
6. Off-hours activity flagging (identifies activity outside business hours: 9 AM–5 PM)
   
   
• Synthesize audit findings into a natural language narrative with risk classification

Inputs:

• TimeRange parameter (configurable lookback period in days; default: 7 days)
• Microsoft Sentinel Log Analytics workspace with ingested table containing AI agent activity telemetry (userEmail, userName, applicationName, resourceType, status, timestamp, payload data)

Outputs:

• Structured audit narrative report including activity summaries, volume analysis, new resource access flags, burst pattern alerts, SQL query inventory, off-hours activity detection
• Risk verdict classification (GREEN/YELLOW/RED) with specific anomalies identified
• Recommended investigation actions and remediation guidance for flagged behaviors