Cisco AI Defense Repeated High Risk Activity — Detection Rule
Detects bursts of five or more distinct Cisco AI Defense event IDs, or three or more occurrences of the same event ID, matching prompt injection, code detection, PII, or PCI guardrails for the same application and connection within ten minutes. Allowed PII/PCI prompt events are handled by Cisco AI Defense Allowed Sensitive Prompt. These patterns can indicate iterative prompt-injection probing or repeated attempts to use an AI application to access restricted data or capabilities.