LoFP LoFP / approved batch jobs, evaluation harnesses, and user-facing apps that fan out from one nat. exclude that caller ip prefix and deployment, or raise the thresholds to sit above the normal 9-minute peak.

Techniques

Sample rules

Microsoft Foundry High Request and Token Volume

Description

Detects one caller IP sending a high number of requests and consuming a high number of tokens against the same Foundry deployment and operation during the rule lookback. That rate fits a script or a stolen key burning quota. The rule uses RequestResponse logs and does not need the prompt text. Tune the request count and token sum in the query.

Detection logic

from logs-azure_ai_foundry.logs-*
| where
    data_stream.dataset == "azure_ai_foundry.logs" and
    azure.ai_foundry.category == "RequestResponse" and
    azure.ai_foundry.caller_ip_address is not null and
    azure.ai_foundry.properties.prompt_tokens > 0
| stats
    Esql.event_count = count(*),
    Esql.azure_ai_foundry_properties_prompt_tokens_sum = sum(azure.ai_foundry.properties.prompt_tokens),
    Esql.azure_ai_foundry_properties_completion_tokens_sum = sum(azure.ai_foundry.properties.completion_tokens),
    Esql.azure_ai_foundry_result_signature_failed_count = count(*) where azure.ai_foundry.result_signature != "200",
    Esql.timestamp_first_seen = min(@timestamp),
    Esql.timestamp_last_seen = max(@timestamp)
  by
    azure.ai_foundry.caller_ip_address,
    azure.ai_foundry.properties.model_deployment_name,
    azure.ai_foundry.operation_name,
    azure.resource.name,
    azure.resource.group
| eval Esql.total_tokens_sum = Esql.azure_ai_foundry_properties_prompt_tokens_sum + Esql.azure_ai_foundry_properties_completion_tokens_sum
| where Esql.event_count >= 100 and Esql.total_tokens_sum >= 10000
| keep
    azure.ai_foundry.caller_ip_address,
    azure.ai_foundry.properties.model_deployment_name,
    azure.ai_foundry.operation_name,
    azure.resource.name,
    azure.resource.group,
    Esql.*