We need answer only headline <=90 chars, new factual, no five-word sequence with external source. Need craft. Facts: Cisco vendors, products

En bref

• Cisco published Project Quarry and its rule language under an open-source model.
• The project focuses on finding AI agent attack patterns made of individually benign actions.
• No CVE is tied to this release; severity is rated medium.
• Defenders should test and tune rules before broad production use.

Cisco has made Project Quarry and the Quarry rule language available as open-source software. The release is aimed at helping security teams identify attacks carried out by AI agents, particularly campaigns assembled from a series of actions that look harmless when viewed one at a time. No CVE has been assigned in connection with the project, and the overall severity is medium.

The effort matters because conventional detections often look for a single malicious event, while agent-driven activity can blend into normal automation. By describing sequences of otherwise benign steps, Quarry-style rules can give defenders a way to flag behavior that only becomes suspicious when the chain is examined as a whole. That makes the project relevant to organizations experimenting with AI agents, workflow automation, and integrations that can act across multiple systems.

Because the project is open source, administrators can inspect the rule syntax, adapt detections to local workflows, and contribute improvements. The same openness means rules should be treated as code: they need review, testing, and version control before they are trusted in production. Organizations should also confirm that their logging and alerting can support sequence-based detection rather than only isolated events.

There is no immediate patch requirement tied to a CVE, so the priority is evaluation and controlled adoption. Watch for community rule updates, false-positive reports from legitimate automation, and changes in how AI agents are deployed in your environment. A staged pilot with monitor-only alerts is the safest way to determine whether Quarry adds useful visibility without overwhelming analysts.

À faire maintenant

1. Inventory AI agents and automation integrations, including owners, data access, and systems they can act on.
2. Review Quarry documentation and rule syntax in an isolated lab before enabling anything in production.
3. Pilot high-value sequence rules in monitor-only mode against representative benign workflows to measure noise.
4. Confirm that endpoint, identity, SaaS, and network logs are available and retained long enough for sequence analysis.
5. Tune thresholds and document exceptions for legitimate automation to reduce analyst fatigue.
6. Roll out detections in stages with rollback plans, then review alerts and rule changes regularly.
7. Track upstream Quarry updates and community rule revisions, re-testing before each production change.

Source originale

SecurityWeek