defender-for-cloud-ai

Name: defender-for-cloud-ai
Author: vinayaklatthe

161stars34forks

How to install defender-for-cloud-ai?

vinayaklatthe/microsoft-security-skills/defender-for-cloud-ai

$npx -y skills add vinayaklatthe/microsoft-security-skills --skill defender-for-cloud-ai

Installs into the current project.

Summary

Guidance for Microsoft Defender for Cloud — AI workload protection (AI-SPM and runtime threat detection for generative AI). Covers AI Security Posture Management (discovery of Azure OpenAI / Azure AI Foundry / Amazon Bedrock / Google Vertex AI resources, identification of groundi

Files · 1

View on GitHub

SKILL.md

1	# Microsoft Defender for Cloud — AI Workload Protection
2
3	Defender for Cloud's AI plan protects the AI workloads themselves — the Azure OpenAI,
4	Azure AI Foundry, Amazon Bedrock, and Google Vertex AI deployments your organization runs.
5	Two capabilities:
6
7	- AI Security Posture Management (AI-SPM): agentless discovery and posture (where AI
8	is deployed, what grounding data is exposed, what misconfigurations exist).
9	- Runtime threat protection for AI workloads: detections on Azure OpenAI for prompt
10	injection, jailbreaks, sensitive-data leakage, wallet abuse, and credential leakage,
11	integrating Azure AI Content Safety Prompt Shields.
12
13	## When to use
14	You build or operate generative AI applications on Azure OpenAI / Azure AI Foundry (and
15	optionally Bedrock/Vertex), and need posture + runtime detection on the workload side.
16
17	Do not use this skill for end-user-side AI governance (`purview-ai-hub`), Content
18	Safety policy authoring (`azure-ai-content-safety`), or M365 Copilot rollout
19	(`copilot-for-m365-readiness`).
20
21	## What you get
22
23	\| Capability \| Scope \|
24	\|---\|---\|
25	\| Multicloud AI discovery \| Azure (OpenAI, Foundry), AWS Bedrock, GCP Vertex AI (via existing multicloud connectors) \|
26	\| Sensitive grounding data exposure \| Identifies grounding storage with sensitive data + public/over-permissive access \|
27	\| Attack path analysis \| "Internet-exposed AI endpoint with sensitive grounding + over-privileged identity" \|
28	\| Runtime detections (Azure OpenAI) \| Prompt injection, jailbreak, sensitive data leakage in prompts/responses, suspicious access patterns, wallet abuse \|
29	\| Prompt Shields integration \| Detections leverage Content Safety prompt-shield signals \|
30	\| Alerts in Defender XDR \| Correlated incidents alongside cloud and identity signals \|
31
32	## Approach
33
34	1. Prereqs. Defender for Cloud enabled at subscription scope. Defender CSPM
35	plan on (provides AI-SPM via attack path analysis). Defender for AI Services
36	runtime plan on for Azure OpenAI workloads. For non-Microsoft clouds, the AWS/GCP
37	connector must already be in place.
38
39	2. Discover AI assets. Within 24 hours of enablement, Defender for Cloud inventory
40	shows Azure OpenAI, Foundry, Bedrock, and Vertex resources. Review the **AI Security
41	posture** dashboard:
42	- Which AI resources are public-network-exposed.
43	- Which use Microsoft Entra (good) vs API key (warns).
44	- Which grounding stores (Azure AI Search, Blob, Cosmos) contain sensitive data
45	classified by Purview, and whether they're over-permissioned.
46
47	3. Triage attack paths first. The high-value paths are typically:
48	- *Internet-exposed Azure OpenAI endpoint + grounding store with sensitive data +
49	identity with broad RBAC.*
50	- *Foundry hub with public networking + customer-managed grounding data + no Content
51	Safety filter.*
52	Fix the path (private endpoint, scope identity, enable Content Safety) rather than
53	triaging each finding in isolation.
54
55	4. Enable runtime detection (Azure OpenAI). Single toggle per subscription. The
56	service samples prompts/responses (subject to your data privacy configuration) and
57	evaluates against Microsoft's threat models plus Prompt Shields.
58
59	5. Wire Content Safety Prompt Shields in your application's Azure OpenAI call
60	chain. Defender alerts gain higher fidelity when Prompt Shields are active because
61	the workload itself has rejected the attempt — Defender now alerts the SOC.
62
63	6. Alert response runbook.
64	- Prompt injection / jailbreak detected: enrich with caller identity, source
65	IP, repeat rate; if persistent, revoke API key / disable user.
66	- Sensitive data leakage in response: investigate grounding data; tighten
67	RBAC on grounding s

People who liked this also viewed

6 picks

Type

defender-for-cloud-ai

161stars34forks

View on GitHub

How to install defender-for-cloud-ai?

vinayaklatthe/microsoft-security-skills/defender-for-cloud-ai

$npx -y skills add vinayaklatthe/microsoft-security-skills --skill defender-for-cloud-ai

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Microsoft Defender for Cloud — AI Workload Protection
2
3	Defender for Cloud's AI plan protects the AI workloads themselves — the Azure OpenAI,
4	Azure AI Foundry, Amazon Bedrock, and Google Vertex AI deployments your organization runs.
5	Two capabilities:
6
7	- AI Security Posture Management (AI-SPM): agentless discovery and posture (where AI
8	is deployed, what grounding data is exposed, what misconfigurations exist).
9	- Runtime threat protection for AI workloads: detections on Azure OpenAI for prompt
10	injection, jailbreaks, sensitive-data leakage, wallet abuse, and credential leakage,
11	integrating Azure AI Content Safety Prompt Shields.
12
13	## When to use
14	You build or operate generative AI applications on Azure OpenAI / Azure AI Foundry (and
15	optionally Bedrock/Vertex), and need posture + runtime detection on the workload side.
16
17	Do not use this skill for end-user-side AI governance (`purview-ai-hub`), Content
18	Safety policy authoring (`azure-ai-content-safety`), or M365 Copilot rollout
19	(`copilot-for-m365-readiness`).
20
21	## What you get
22
23	\| Capability \| Scope \|
24	\|---\|---\|
25	\| Multicloud AI discovery \| Azure (OpenAI, Foundry), AWS Bedrock, GCP Vertex AI (via existing multicloud connectors) \|
26	\| Sensitive grounding data exposure \| Identifies grounding storage with sensitive data + public/over-permissive access \|
27	\| Attack path analysis \| "Internet-exposed AI endpoint with sensitive grounding + over-privileged identity" \|
28	\| Runtime detections (Azure OpenAI) \| Prompt injection, jailbreak, sensitive data leakage in prompts/responses, suspicious access patterns, wallet abuse \|
29	\| Prompt Shields integration \| Detections leverage Content Safety prompt-shield signals \|
30	\| Alerts in Defender XDR \| Correlated incidents alongside cloud and identity signals \|
31
32	## Approach
33
34	1. Prereqs. Defender for Cloud enabled at subscription scope. Defender CSPM
35	plan on (provides AI-SPM via attack path analysis). Defender for AI Services
36	runtime plan on for Azure OpenAI workloads. For non-Microsoft clouds, the AWS/GCP
37	connector must already be in place.
38
39	2. Discover AI assets. Within 24 hours of enablement, Defender for Cloud inventory
40	shows Azure OpenAI, Foundry, Bedrock, and Vertex resources. Review the **AI Security
41	posture** dashboard:
42	- Which AI resources are public-network-exposed.
43	- Which use Microsoft Entra (good) vs API key (warns).
44	- Which grounding stores (Azure AI Search, Blob, Cosmos) contain sensitive data
45	classified by Purview, and whether they're over-permissioned.
46
47	3. Triage attack paths first. The high-value paths are typically:
48	- *Internet-exposed Azure OpenAI endpoint + grounding store with sensitive data +
49	identity with broad RBAC.*
50	- *Foundry hub with public networking + customer-managed grounding data + no Content
51	Safety filter.*
52	Fix the path (private endpoint, scope identity, enable Content Safety) rather than
53	triaging each finding in isolation.
54
55	4. Enable runtime detection (Azure OpenAI). Single toggle per subscription. The
56	service samples prompts/responses (subject to your data privacy configuration) and
57	evaluates against Microsoft's threat models plus Prompt Shields.
58
59	5. Wire Content Safety Prompt Shields in your application's Azure OpenAI call
60	chain. Defender alerts gain higher fidelity when Prompt Shields are active because
61	the workload itself has rejected the attempt — Defender now alerts the SOC.
62
63	6. Alert response runbook.
64	- Prompt injection / jailbreak detected: enrich with caller identity, source
65	IP, repeat rate; if persistent, revoke API key / disable user.
66	- Sensitive data leakage in response: investigate grounding data; tighten
67	RBAC on grounding s

People who liked this also viewed

6 picks

Type