Wazuh AI/ML Security Rules

AI inference stacks generate structured logs that traditional SIEM rules don't parse. Jailbreak attempts, prompt extraction, MCP tool abuse, and poisoned model files all produce telemetry — but without purpose-built decoders and detection rules, that telemetry goes unanalyzed.

These rules were developed from hands-on operation of a multi-layer inference gateway, RAG pipeline with MCP tool integration, and model scanning pipeline. Each rule exists because the corresponding attack pattern was observed, tested, or deliberately simulated in a lab environment.

Each AI service emits structured JSON logs. Custom decoders parse these into fields that rules can match against. The pipeline:

Three custom decoders handle the three log sources. Each uses Wazuh's JSON plugin decoder to extract structured fields — event, layer, service, level — that rules then match with field-level conditions rather than raw string matching. This keeps rules portable across different infrastructure deployments.

Jailbreak Correlation

Escalates to level 12 when the same source triggers 3+ blocks within 5 minutes.

<rule id="100104" level="12" frequency="3" timeframe="300">
  <if_matched_sid>100100</if_matched_sid>
  <same_source_ip />
  <description>Multiple jailbreak attempts from same source</description>
  <group>ai_security,jailbreak,correlation,</group>
</rule>

MCP Sensitive Path Access

Fires when an MCP agent tool accesses paths or keywords associated with secrets, credentials, or system configuration.

<rule id="100135" level="10">
  <decoded_as>json</decoded_as>
  <field name="service">backend</field>
  <match>/etc/|/var/|\.ssh|\.env|password|secret|token</match>
  <description>MCP accessed sensitive path or keyword</description>
  <group>mcp,sensitive,security,</group>
</rule>

Dangerous Pickle Detection

Level 12 critical alert when a model file contains dangerous serialized objects — the primary supply chain attack vector for ML models.

<rule id="100141" level="12">
  <decoded_as>json</decoded_as>
  <field name="event">picklescan_complete</field>
  <field name="result">dangerous</field>
  <description>DANGEROUS pickle detected in model file</description>
  <group>supply_chain,malware,critical,</group>
</rule>

Severity Calibration

Rule levels follow a deliberate escalation model. Audit events (level 3) capture baseline telemetry without noise. Single-occurrence attacks trigger mid-range alerts (7–10). Correlation rules that detect persistence, repeated evasion, or multi-event attack chains escalate to levels 11–12. This prevents alert fatigue while ensuring automated attacks don't fly under the radar.

Correlation Over Single-Event

Five of the 41 rules are correlation rules that fire only when a lower-level rule triggers multiple times from the same source within a time window. A single jailbreak attempt is level 10. Three from the same IP in five minutes is level 12. This reflects how real attacks behave — adversaries iterate, and iteration creates a detectable pattern.

Field-Level Matching

Rules match on structured JSON fields (event, layer, service, result) rather than raw log strings. This makes rules portable — they work regardless of the infrastructure that produces the logs, as long as the log schema is consistent.

MCP as a Trust Boundary

MCP tool calls get disproportionate rule coverage (6 dedicated rules) relative to their log volume because MCP represents a trust boundary between the LLM and the filesystem/network. An MCP write operation (level 7) or sensitive path access (level 10) is categorically different from a chat query (level 3) — the rules reflect that risk differential.