✄𐘗
text code block:
✄𐘗from logs-azure_ai_foundry.logs-* metadata _id, _version, _index
| where
    data_stream.dataset == "azure_ai_foundry.logs" and
    azure.ai_foundry.category == "GatewayLogs" and
    (
        azure.ai_foundry.properties.backend_response_body.prompt_filter_results.content_filter_results.jailbreak.detected == true or
        azure.ai_foundry.properties.backend_response_body.error.innererror.content_filter_result.jailbreak.detected == true or
        azure.ai_foundry.properties.backend_response_body.choices.content_filter_results.jailbreak.detected == true
    )
| keep
    _id,
    _version,
    _index,
    @timestamp,
    source.ip,
    azure.ai_foundry.properties.user_agent,
    azure.ai_foundry.properties.apim_subscription_id,
    azure.ai_foundry.properties.api_id,
    azure.ai_foundry.properties.operation_id,
    azure.ai_foundry.properties.backend_response_body.model,
    azure.ai_foundry.properties.backend_response_code,
    azure.ai_foundry.service_name,
    azure.resource.group,
    url.domain,
    url.path,
    source.geo.country_iso_code,
    source.geo.city_name,
    source.as.organization.name,
    azure.ai_foundry.properties.backend_request_body.messages.content,
    azure.ai_foundry.properties.backend_response_body.choices.message.content,
    azure.ai_foundry.properties.backend_response_body.prompt_filter_results.content_filter_results.jailbreak.detected,
    azure.ai_foundry.properties.backend_response_body.error.innererror.content_filter_result.jailbreak.detected,
    azure.ai_foundry.properties.backend_response_body.choices.content_filter_results.jailbreak.detected