heroui logo

Potential Denial of Azure OpenAI ML Service

Elastic Detection Rules

View Source
Summary
The detected rule titled 'Potential Denial of Azure OpenAI ML Service' is designed to identify potential Denial-of-Service (DoS) attacks targeting machine learning models, specifically within the Azure OpenAI Service. It focuses on recognizing patterns associated with unusually high volumes or frequencies of requests, as well as specific request patterns that could lead to service degradation. This includes requests with large input sizes or rapid sends to the API. The rule operates with an ESQL query that filters logs from Azure OpenAI, truncates timestamps to one-minute windows, and evaluates the operation 'ChatCompletions_Create'. If the rule observes 10 or more requests with an average size exceeding 5000 bytes within a minute, it flags them as potentially harmful, thus aiding in the mitigation of service interruptions. The rule is intended for use in production, following successful testing. Notably, it carries a medium severity and a risk score of 47, indicating potential risk that should be monitored.
Categories
  • Cloud
  • Application
  • Identity Management
Data Sources
  • Cloud Service
  • Application Log
ATT&CK Techniques
  • T0029
Created: 2025-02-25