This rule deploys a machine-learning anomaly-detection job to flag AWS Bedrock model invocations where the model requests a tool that is uncommon for the caller relative to that caller’s history. The job (security_ai_bedrock_asi02_rare_tool) analyzes logs from Bedrock invocations (logs-aws_bedrock.invocation-*) and computes tool_name usage per user (partitioned by user.id) using a rarity metric (rare function) within one-hour buckets. An alert is generated when the anomaly score (0–100) exceeds the configured threshold (50 by default) to indicate a potential deviation from normal behavior. Importantly, the detected item is the tool name requested by the model in its output, not a tool execution; thus, it signals possible misuse, prompt injection, or unsafe delegation (referencing OWASP ASI02). The rule maps to MITRE ATLAS AML.T0053 (AI Agent Tool Invocation) under AML.TA0005 (Execution) to highlight a potential execution pathway via AI agent tooling. The detection relies on per-caller baselines; AWS Bedrock identifiers often embed account and session details, which affects how baselines are established (distinct session names yield separate baselines). The rule emphasizes that ML rarity is not a deterministic control and notes that tools may be misused or mischaracterized when introduced or rarely used. The setup requires enabling the Security for AI integration, the AWS Bedrock integration, and provisioning Bedrock invocation logs to Elastic. The rule provides detailed triage guidance, false-positive considerations, and remediation steps, including restricting suspect tools or permissions, auditing prompt integrity, rotating credentials if a tool was actually used, and maintaining allowlists/denylists for tools. This rule is intended for cloud-based AI risk monitoring and is aligned with GenAI security use cases.