Depreciated AI Detections

[peppers-joseph]

https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-aiagentsinfo-table

Appears usage of AIAgentsInfo is now depcreated and not working, so usages of it now break.

https://github.com/SlimKQL/Detections.AI/blob/main/KQL/agent-365--local-ai-agent-installation-detection.kql

These KQL agents would all need to be updated to use the combined AgentsInfo table such as

AgentsInfo
| where CreatedDateTime > ago(14d)
| where Platform == "LocalAgents"
| extend Vendor     = tostring(RawAgentInfo.localAgentMetadata.vendor)
| extend DeviceName = tostring(RawAgentInfo.localAgentMetadata.deviceName)
| extend OSPlatform = tostring(RawAgentInfo.localAgentMetadata.osPlatform)
| extend UserName   = tostring(RawAgentInfo.localAgentMetadata.accountName)
| extend AccountSid = tostring(RawAgentInfo.localAgentMetadata.accountSid)
| project
    Vendor,
    AISoftwareName = Name,
    DeviceName,
    OSPlatform,
    UserName,
    AccountSid

I see one other usage at

Detections.AI/KQL/agent365-autojack-detection.kql

Line 4 in e16f7e3

| where Platform == @"LocalAgents"