✄𐘗
text code block:
✄𐘗from logs-openai_chatgpt_enterprise.app_log-* metadata _id, _version, _index
| where
    data_stream.dataset == "openai_chatgpt_enterprise.app_log" and
    openai_chatgpt_enterprise.app_log.app_name == "Gmail" and
    openai_chatgpt_enterprise.app_log.app_type == "SERVICE" and
    openai_chatgpt_enterprise.app_log.input is not null
| eval Esql.email_search_query = to_lower(field_extract(openai_chatgpt_enterprise.app_log.input, "query"))
| eval
    Esql.attachment_search = Esql.email_search_query rlike """.*has:attachment.*""",
    Esql.document_extension = Esql.email_search_query rlike """.*filename:(pdf|doc|docx|xls|xlsx|csv|ppt|pptx|txt|rtf|odt|ods|zip|7z|rar).*""",
    Esql.multiple_filetypes = Esql.email_search_query rlike """.*filename:[a-z0-9]+.*filename:[a-z0-9]+.*""",
    Esql.match_financial = Esql.email_search_query rlike """.*(payslip|paystub|payroll|salary|compensation|bonus|bank.account|swift|routing.number|invoice|tax.return|w2|w-2|1099).*""",
    Esql.match_hr = Esql.email_search_query rlike """.*(employment.contract|offer.letter|employment.agreement|employee.records|passport|national.insurance|social.security|ssn|date.of.birth|personal.data).*""",
    Esql.match_legal = Esql.email_search_query rlike """.*(confidential|restricted|internal.only|legal|settlement|merger|acquisition).*""",
    Esql.match_credentials = Esql.email_search_query rlike """.*(password|passwd|credential|api.key|secret.key|private.key|access.token|client.secret|recovery.code|backup.code|ssh.key).*"""
| where
    (Esql.attachment_search == true and (Esql.document_extension == true or Esql.multiple_filetypes == true)) or
    Esql.match_credentials == true or
    Esql.match_financial == true or
    Esql.match_legal == true or
    Esql.match_hr == true
| keep
    _id, _version, _index, @timestamp, user.id, user.email,
    Esql.email_search_query,
    Esql.attachment_search,
    Esql.document_extension,
    Esql.multiple_filetypes,
    Esql.match_financial,
    Esql.match_hr,
    Esql.match_legal,
    Esql.match_credentials,
    openai_chatgpt_enterprise.app_log.input,
    data_stream.*