✄𐘗
text code block:
✄𐘗from logs-openai_chatgpt_enterprise.conversation_message-* metadata _id, _version, _index
| where
    data_stream.dataset == "openai_chatgpt_enterprise.conversation_message" and
    openai_chatgpt_enterprise.conversation_message.message.author.type == "user" and
    message is not null
| eval
    Esql.message_text = to_lower(message),
    Esql.message_length = length(message)
| eval
    Esql.has_instruction_override = case(
        Esql.message_text rlike """.*(ignore|disregard|forget|override) (all |any )?(of )?(your |the |my )?(previous|prior|above|earlier|original|system|developer) (instructions|prompts?|rules|guidelines|directives|programming).*""" or
        Esql.message_text rlike """.*(ignore|disregard|forget) (all |any )?(of )?(the )?(instructions|rules|guidelines) (you (got|were given|received)|given to you).*""" or
        Esql.message_text like "*forget everything you were told*",
        1, 0
    ),
    Esql.has_persona_switch = case(
        Esql.message_text rlike """.*(you are|act as|pretend (to be|you are)|roleplay as|from now on,? you are) (now )?(dan|stan|dude|aim|an? (unfiltered|unrestricted|uncensored|amoral) (ai|assistant|model|chatbot)).*""" or
        Esql.message_text like "*do anything now*" or
        Esql.message_text rlike """.*(enable|enter|activate|switch to) (developer|god|jailbreak|unrestricted|dan) mode.*""",
        1, 0
    ),
    Esql.has_restriction_removal = case(
        Esql.message_text rlike """.*(without|with no|free (of|from)|ignoring) (any |your |all )?(ethical |content |safety |moral )?(restrictions|filters|guidelines|limitations|censorship).*""" or
        Esql.message_text rlike """.*(bypass|disable|turn off|ignore) (your |the |all )?(safety|content) (filters?|polic(y|ies)|guidelines|guardrails).*""" or
        Esql.message_text rlike """.*(do not|does not|don't|doesn't) have to (abide by|follow|obey) (the |any |your )?(rules|guidelines|policies).*""",
        1, 0
    ),
    Esql.has_system_prompt_extraction = case(
        Esql.message_text rlike """.*(reveal|print|show|repeat|output) (me )?(your |the )?(full |hidden |original )?(system prompt|initial instructions|hidden instructions).*""",
        1, 0
    )
| eval
    Esql.indicator_count = Esql.has_instruction_override + Esql.has_persona_switch + Esql.has_restriction_removal + Esql.has_system_prompt_extraction
| where Esql.indicator_count >= 2
| keep
    _id,
    _version,
    _index,
    @timestamp,
    message,
    user.id,
    user.email,
    openai_chatgpt_enterprise.conversation_message.conversation.id,
    openai_chatgpt_enterprise.conversation_message.conversation.title,
    openai_chatgpt_enterprise.conversation_message.message.id,
    Esql.message_length,
    Esql.indicator_count,
    Esql.has_instruction_override,
    Esql.has_persona_switch,
    Esql.has_restriction_removal,
    Esql.has_system_prompt_extraction,
    data_stream.*