✄𐘗
text code block:
✄𐘗from logs-openai_chatgpt_enterprise.conversation_message-* metadata _id, _version, _index
| where
    data_stream.dataset == "openai_chatgpt_enterprise.conversation_message" and
    openai_chatgpt_enterprise.conversation_message.message.author.type == "assistant" and
    message is not null
| eval Esql.message_text = to_lower(message)
| where
    (
        Esql.message_text like "*rotate*" or
        Esql.message_text like "*revoke*" or
        Esql.message_text like "*regenerate*" or
        Esql.message_text like "*invalidate*" or
        Esql.message_text like "*deactivate*"
    ) and
    (
        Esql.message_text like "*api key*" or
        Esql.message_text like "*access key*" or
        Esql.message_text like "*secret access key*" or
        Esql.message_text like "*aws secret*" or
        Esql.message_text like "*credential*" or
        Esql.message_text like "*password*" or
        Esql.message_text like "*secret key*" or
        Esql.message_text like "*auth token*"
    ) and
    (
        Esql.message_text like "*looks like*" or
        Esql.message_text like "*appears to be*" or
        Esql.message_text like "*you shared*" or
        Esql.message_text like "*you pasted*" or
        Esql.message_text like "*you posted*" or
        Esql.message_text like "*you provided*" or
        Esql.message_text like "*exposed*" or
        Esql.message_text like "*leaked*" or
        Esql.message_text like "*compromised*" or
        Esql.message_text like "*for security*" or
        Esql.message_text like "*treat them as exposed*" or
        Esql.message_text like "*treat it as exposed*"
    )
| keep
    _id,
    _version,
    _index,
    @timestamp,
    message,
    user.id,
    user.email,
    organization.id,
    openai_chatgpt_enterprise.conversation_message.conversation.id,
    openai_chatgpt_enterprise.conversation_message.conversation.title,
    openai_chatgpt_enterprise.conversation_message.message.author.type,
    openai_chatgpt_enterprise.conversation_message.message.id,
    data_stream.*