u/phantomask99

inspired by https://detect.fyi/your-endpoints-are-running-local-ai-agents-can-you-see-them-338c773f4397, so MSFT has a separate table to record the AI Agents' activities. I wonder if we can do something similar via CS NGSIEM CQL, or if CS already supports that and I missed it?

ref:

https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-aiagentsinfo-table