Skip to content

Add Vaikora AI Agent Signals to Azure Security Center — Microsoft Sentinel Solution v1.0.0#13986

Open
mazamizo21 wants to merge 48 commits intoAzure:masterfrom
mazamizo21:feature/vaikora-azure-security-center-v1.0.0
Open

Add Vaikora AI Agent Signals to Azure Security Center — Microsoft Sentinel Solution v1.0.0#13986
mazamizo21 wants to merge 48 commits intoAzure:masterfrom
mazamizo21:feature/vaikora-azure-security-center-v1.0.0

Conversation

@mazamizo21
Copy link
Copy Markdown
Contributor

Vaikora AI Agent Signals to Azure Security Center — Microsoft Sentinel Solution v1.0.0

This PR adds a Logic App playbook solution that polls Vaikora AI agent behavioral signals and creates security alerts in Microsoft Defender for Cloud (Azure Security Center).

What's included

Logic App Playbook (azuredeploy.json)

  • Runs on a configurable schedule (default: every 6 hours)
  • Polls Vaikora GET /api/v1/actions for high-risk + anomalous agent actions
  • Authenticates to Azure using Managed Identity
  • Creates custom security alerts via Defender for Cloud Alerts REST API

3 Analytic Rules

  • High Severity Security Alerts — detects Vaikora critical/high risk AI agent events
  • Behavioral Anomaly Detection — detects anomalous AI agent behavior patterns
  • Feed Outage Detection — alerts when Vaikora signal ingestion stops

Signal Mapping

  • risk_level: critical → Defender alert severity: High
  • risk_level: high → Defender alert severity: Medium
  • is_anomaly: true → alert category: Behavioral
  • threat_detected: true → alert category: Threat Intelligence

Parameters

  • VaikoraApiKey (securestring)
  • VaikoraAgentId
  • SubscriptionId (Azure subscription for Defender for Cloud)
  • WorkspaceResourceGroup
  • WorkspaceName

Publisher

Data443 Risk Mitigation, Inc. — support@data443.com

@mazamizo21 mazamizo21 requested review from a team as code owners April 3, 2026 06:56
@v-shukore v-shukore self-assigned this Apr 3, 2026
@v-shukore v-shukore added the New Solution For new Solutions which are new to Microsoft Sentinel label Apr 3, 2026
@mazamizo21 mazamizo21 force-pushed the feature/vaikora-azure-security-center-v1.0.0 branch from 6c546b5 to f3ea143 Compare April 3, 2026 14:59
@mazamizo21
Copy link
Copy Markdown
Contributor Author

Hi @v-maheshbh — done! Repackaged with version 3.0.0. Package/3.0.0.zip is now included. Thanks!

Taz Jack added 5 commits April 3, 2026 12:13
…ntId1), parentId bracket, arm-ttk clean (47-48/49 matching Cyren baseline)
Vaikora GET /api/v1/actions returns {actions:[...], total:N} not bare array.
Fix For_Each 'from' to extract ?['actions'] from envelope.

Fixes VaikoraToAzureSecurityCenter azuredeploy.json + mainTemplate.json (PR Azure#13986).
@v-shukore
Copy link
Copy Markdown
Contributor

Hi @mazamizo21, accidently you have added multiple solutions in this PR please remove it all and keep relevant solution in this PR. Thanks!

@v-shukore
Copy link
Copy Markdown
Contributor

Hi @mazamizo21, please resolve branch conflicts. Thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

New Solution For new Solutions which are new to Microsoft Sentinel

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants