[New Rule] AWS Bedrock AgentCore Cross-Actor User Preference Memory Access

### Description

I would like to propose a behavior-based detection for cross-actor use of an Amazon Bedrock AgentCore user-preference memory namespace.

Amazon Bedrock AgentCore uses actorId to identify the entity that memory belongs to. AWS documents actor-scoped namespaces as the standard way to keep user memories separated, and the default namespace for UserPreferenceMemoryStrategy is actor-scoped:

/strategy/{memoryStrategyId}/actors/{actorId}/

The Elastic aws_bedrock_agentcore integration already exposes the fields needed to identify a potential breakdown of that isolation boundary in memory_application_logs, including:

- aws.bedrock_agentcore.memory.memory_name
- aws.bedrock_agentcore.memory.memory_strategy
- aws.bedrock_agentcore.memory.memory_strategy_id
- aws.bedrock_agentcore.memory.namespace
- aws.bedrock_agentcore.memory.actor_id
- aws.bedrock_agentcore.memory.session_id
- event.outcome

The behavior I would like to detect is a single user-preference memory namespace being used successfully by more than one distinct actor ID.

For a user-preference strategy, this may indicate that actor isolation has been lost through a custom/shared namespace, an authorization/configuration error, cross-user memory contamination, or deliberate attempts to influence memory used for another actor.

This is particularly relevant for agentic applications because user-preference memory persists across sessions and can influence future agent behavior.

The proposed rule is behavioral rather than prompt-content based. It does not depend on matching phrases or prompt text and therefore cannot be bypassed simply by rephrasing an input.

Potential legitimate cases include deliberately shared custom namespaces, migrations, integration tests, and applications intentionally designed to share preference memory across actors. These environments could tune or exempt the corresponding namespace.

I searched the current elastic/detection-rules repository and could not find an existing prebuilt rule using the aws_bedrock_agentcore.memory_application_logs data stream or specifically detecting cross-actor use of AgentCore Memory.

### Target Ruleset

other

### Target Rule Type

ES|QL

### Tested ECS Version

_No response_

### Query

FROM logs-aws_bedrock_agentcore.memory_application_logs-*
| WHERE event.outcome == "success"
AND aws.bedrock_agentcore.memory.memory_strategy == "user_preferences"
AND aws.bedrock_agentcore.memory.actor_id IS NOT NULL
AND aws.bedrock_agentcore.memory.namespace IS NOT NULL
| STATS
Esql.actor_count = COUNT_DISTINCT(aws.bedrock_agentcore.memory.actor_id),
Esql.session_count = COUNT_DISTINCT(aws.bedrock_agentcore.memory.session_id)
BY aws.bedrock_agentcore.memory.memory_name,
aws.bedrock_agentcore.memory.memory_strategy_id,
aws.bedrock_agentcore.memory.namespace
| WHERE Esql.actor_count > 1
| SORT Esql.actor_count DESC

### New fields required in ECS/data sources for this rule?

None.

The required fields are already defined by the aws_bedrock_agentcore memory_application_logs integration, including memory_name, memory_strategy, memory_strategy_id, namespace, actor_id, session_id, and the standard event.outcome field.

### Related issues or PRs

Related broader Agentic AI detection discussion:

https://github.com/elastic/detection-rules/issues/6126

This proposal is distinct from the runtime prompt and gateway tool-call detections because it targets the AgentCore Memory data stream and specifically the long-term memory isolation boundary.

### References

https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/user-preference-memory-strategy.html

https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/memory-organization.html

https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/specify-long-term-memory-organization.html

https://github.com/elastic/integrations/blob/main/packages/aws_bedrock_agentcore/data_stream/memory_application_logs/fields/fields.yml

https://github.com/elastic/integrations/blob/main/packages/aws_bedrock_agentcore/data_stream/memory_application_logs/sample_event.json

### Redacted Example Data

Live positive/negative lab telemetry is pending. I will add redacted example data after reproducing the cross-actor memory condition in an AgentCore Memory test environment.

Start by reviewing the proposed ES|QL query and the AgentCore integration fields.yml and sample_event.json referenced in the issue. Check the repository’s existing detection-rule conventions, then validate the rule against positive and negative telemetry once the promised redacted examples are available. Done means the rule detects successful user-preference namespaces used by multiple actor IDs without requiring new ECS fields.

Written by the indexing model from the issue text.