from logs-aws_bedrock.invocation-*

// Expand multi-valued policy name field
| mv_expand gen_ai.policy.name

// Filter for blocked actions related to sensitive info policy
| where
  gen_ai.policy.action == "BLOCKED"
  and gen_ai.compliance.violation_detected == "true"
  and gen_ai.policy.name == "sensitive_information_policy"

// keep only relevant fields
| keep user.id

// count how many times each user triggered a sensitive info block
| stats
    Esql.ml_policy_blocked_sensitive_info_count = count()
  by user.id

// Filter for users with more than 5 violations
| where Esql.ml_policy_blocked_sensitive_info_count > 5

// sort highest to lowest
| sort Esql.ml_policy_blocked_sensitive_info_count desc