This rule implements a machine-learning anomaly-detection job named security_ai_bedrock_asi02_large_tool_batch to detect unusually large numbers of tool-use invocations in a single AWS Bedrock model response. It analyzes per-caller behavior (partitioned by user.id) across 15-minute buckets within a 60-minute look-back window. The detector emits an anomaly score from 0 to 100, with a configured threshold of 50 triggering an alert when the largest per-response tool-use count in a bucket deviates from the caller’s historical baseline. The metric is the count of tool-use IDs in gen_ai.output.messages.content.toolUse.toolUseId derived from successful Converse/ConverseStream invocations, not actual confirmed tool executions. This helps identify potential over-invocation of tools by an AI agent, which could indicate prompt-injection, unsafe delegation, or tool misuse (aligned with MITRE ATLAS AML.T0053 and AML.TA0005). The rule relies on data shipped from AWS Bedrock logs (logs-aws_bedrock.invocation-*) and the Security for AI integration assets and is intended to run alongside Bedrock model invocation telemetry. False positives can arise from legitimate bulk-processing tasks or new prompts that increased batch tool requests, or from new adopters with limited history, and should be mitigated by workload documentation, threshold adjustments, or scoped exceptions. Note that anomaly scores reflect behavior patterns, not intent or confirmed authorization, and scores may fade with recurring but benign behavior. Possible remediation includes restricting agent execution permissions or tool integrations, enforcing per-response tool-call limits, rotating credentials if prompt injection is suspected, and escalation to the agent owner and AI security team. The rule maps to MITRE ATLAS AML.T0053 (AI Agent Tool Invocation) under Execution, with related mapping to AML.TA0005. See setup and references for enabling the ML job and interpreting results.