from logs-aws_bedrock.invocation-*

// keep token usage data
| keep
  user.id,
  gen_ai.usage.prompt_tokens,
  gen_ai.usage.completion_tokens

// Aggregate usage metrics
| stats
    Esql.ml_usage_prompt_tokens_max = max(gen_ai.usage.prompt_tokens),
    Esql.ml_invocations_total_count = count(*),
    Esql.ml_usage_completion_tokens_avg = avg(gen_ai.usage.completion_tokens)
  by
    user.id

// Filter for suspicious usage patterns
| where
  Esql.ml_usage_prompt_tokens_max > 5000
  and Esql.ml_invocations_total_count > 10
  and Esql.ml_usage_completion_tokens_avg > 500

// Calculate a custom risk factor
| eval Esql.ml_risk_score =
    (Esql.ml_usage_prompt_tokens_max / 1000) *
    Esql.ml_invocations_total_count *
    (Esql.ml_usage_completion_tokens_avg / 500)

// Filter on risk score
| where Esql.ml_risk_score > 10

// sort high risk users to top
| sort Esql.ml_risk_score desc