Unusual High Confidence Content Filter Blocks Detected
Detects repeated high-confidence 'BLOCKED' actions coupled with specific 'Content Filter' policy violation having codes such as 'MISCONDUCT', 'HATE', 'SEXUAL', INSULTS', 'PROMPT_ATTACK', 'VIOLENCE' indicating…
Description
Detects repeated high-confidence 'BLOCKED' actions coupled with specific 'Content Filter' policy violation having codes such as 'MISCONDUCT', 'HATE', 'SEXUAL', INSULTS', 'PROMPT_ATTACK', 'VIOLENCE' indicating persistent misuse or attempts to probe the model's ethical boundaries.
Detection logic
Its licence does not clear it for publishing here
Sunturai publishes a detection's own text where the licence it arrived under has been reviewed and permits it, and Elastic License 2.0 has not. The query as its source wrote it, its canonical form and the hash that pins this revision are in the workspace record.
Known benign triggers
- New model deployments.
- Testing updates to compliance policies.
MITRE ATT&CK mappings
Not mapped to ATT&CK.
References
| Reference | Cited by |
|---|---|
| atlas.mitre.org/techniques/AML.T0051 | 8 |
| atlas.mitre.org/techniques/AML.T0054 | 7 |
| docs.aws.amazon.com/bedrock/latest/userguide/guardrails-components.html | 8 |
| www.elastic.co/security-labs/elastic-advances-llm-security | 21 |
From the source
- At source
- Open at source
- Upstream identifier
- 4f855297-c8e0-4097-9d97-d653f7e471c4
- Tagged by the source as
- Data Source: AWS BedrockData Source: AWS S3Domain: LLMMitre Atlas: T0051Mitre Atlas: T0054Resources: Investigation GuideUse Case: Policy Violation
Licence
- Published under
- Elastic License 2.0Read the licence
- Attribution
- Required
Authorship
- Written by
- Published
- Aug 27, 2026
- Version
- 1