Amazon Bedrock

This brief outlines the detection of hostile or aggressive prompt sentiment sent to AWS Bedrock Claude large language models, indicating potential abuse, harassment, or attempts at model manipulation, requiring the configuration of Bedrock model invocation logging and Splunk ingestion.

This detection identifies anomalous behavior in AWS Bedrock Claude where an identity generates excessively large model responses compared to its historical average, signaling potential bulk data exfiltration, successful prompt injection leading to verbose output, or a runaway agentic loop indicative of abuse or compromise of the large language model.