LoFP LoFP / borderline creative-writing or news-summarization prompts can occasionally score medium. confirm category and prompt text before escalating.

Techniques

Sample rules

GCP Vertex AI Elevated Safety Rating on Response

Description

Detects Vertex AI prompt-response logs where a candidate safety_ratings.probability is HIGH or MEDIUM. Those values are stronger signals than NEGLIGIBLE or LOW alone. Requires the request to include safetySettings so ratings are logged.

Detection logic

from logs-gcp_vertexai.prompt_response_logs-* metadata _id, _version, _index
| where
    data_stream.dataset == "gcp_vertexai.prompt_response_logs" and
    (
        MV_CONTAINS(gcp.vertexai.prompt_response_logs.full_response.candidates.safety_ratings.probability, "HIGH") or
        MV_CONTAINS(gcp.vertexai.prompt_response_logs.full_response.candidates.safety_ratings.probability, "MEDIUM")
    )
| keep
    _id,
    _version,
    _index,
    @timestamp,
    cloud.project.id,
    gcp.vertexai.prompt_response_logs.model,
    gcp.vertexai.prompt_response_logs.api_method,
    gcp.vertexai.prompt_response_logs.full_request.contents.parts.text,
    gcp.vertexai.prompt_response_logs.full_request.safety_settings.threshold,
    gcp.vertexai.prompt_response_logs.full_response.candidates.finish_reason,
    gcp.vertexai.prompt_response_logs.full_response.candidates.safety_ratings.category,
    gcp.vertexai.prompt_response_logs.full_response.candidates.safety_ratings.probability,
    gcp.vertexai.prompt_response_logs.full_response.candidates.safety_ratings.severity