LoFP LoFP / approved batch evaluation or high-traffic applications. raise thresholds above the normal peak per model.

Techniques

Sample rules

GCP Vertex AI High Request and Token Volume

Description

Detects a high number of Vertex AI prompt-response log rows and high total token usage for one model in the lookback window. Totals use provider usage_metadata.total_token_count (includes thinking tokens when billed). High request and token volume can indicate model extraction, quota abuse, or a compromised caller. Tune thresholds for your baseline.

Detection logic

from logs-gcp_vertexai.prompt_response_logs-*
| where
    data_stream.dataset == "gcp_vertexai.prompt_response_logs" and
    gcp.vertexai.prompt_response_logs.full_response.usage_metadata.prompt_token_count > 0
| stats
    Esql.event_count = count(*),
    Esql.prompt_tokens_sum = sum(gcp.vertexai.prompt_response_logs.full_response.usage_metadata.prompt_token_count),
    Esql.candidates_tokens_sum = sum(gcp.vertexai.prompt_response_logs.full_response.usage_metadata.candidates_token_count),
    Esql.total_tokens_sum = sum(gcp.vertexai.prompt_response_logs.full_response.usage_metadata.total_token_count),
    Esql.timestamp_first_seen = min(@timestamp),
    Esql.timestamp_last_seen = max(@timestamp)
  by
    gcp.vertexai.prompt_response_logs.model,
    cloud.project.id
| where Esql.event_count >= 100 and Esql.total_tokens_sum >= 10000
| keep
    gcp.vertexai.prompt_response_logs.model,
    cloud.project.id,
    Esql.event_count,
    Esql.prompt_tokens_sum,
    Esql.candidates_tokens_sum,
    Esql.total_tokens_sum,
    Esql.timestamp_first_seen,
    Esql.timestamp_last_seen