This rule implements a machine-learning detector that flags unusually high volumes of tool-request activity in AWS Bedrock model invocations. The ML job, security_ai_bedrock_asi02_high_tool_volume, monitors responses that request tools within a 15-minute window and compares the volume to the caller’s historical baseline (partitioned by user.id). The anomaly score (0–100) is evaluated against an anomaly_threshold of 50; a higher score indicates behavior deviating from the caller’s norm. Importantly, the metric measures tool-use requests generated by the model (gen_ai.output.messages.content.toolUse...), not confirmed tool executions, so it signals potential misuses or looping prompts rather than verified malicious actions. Baselines are per caller, with complexities for AWS ARNs and session-based identifiers that can lead to separate baselines per session or role; a stable role name across accounts could allow shared baselines in future updates. The rule emphasizes that true positives hinge on unusual tool-request patterns, while misuses or repeated prompts at normal volumes may not imply wrongdoing. False positives include legitimate bursts from batch jobs, load tests, or onboarding, and client retries. The recommended response includes investigating caller identity and the precise tool names or looped requests, throttling or disabling agents if the burst is unexpected, and implementing rate limits and maximum-iteration controls. Setup requires AWS Bedrock logs and Security for AI assets, with ingestion of logs from logs-aws_bedrock.invocation-* and fields like user.id, cloud.account.id, and tool-use data. The rule aligns to MITRE ATLAS AML.T0053 (AI Agent Tool Invocation) and AML.T0034 (Cost Harvesting).