LoFP / developers may paste example keys while debugging or documenting integrations.

from logs-openai_chatgpt_enterprise.codex_log-* metadata _id, _version, _index
| eval Esql.prompt_text = coalesce(openai_chatgpt_enterprise.codex_log.event_details.prompt_text, "")
| eval Esql.response_text = coalesce(openai_chatgpt_enterprise.codex_log.event_details.response_text, "")
| where
    data_stream.dataset == "openai_chatgpt_enterprise.codex_log" and
    event.action == "prompt_response_received" and
    (
        (
        Esql.prompt_text is not null and
        Esql.prompt_text != "" and
        not Esql.prompt_text like "*AKIAIOSFODNN7EXAMPLE*" and
        not Esql.prompt_text like "*ASIAIOSFODNN7EXAMPLE*" and
        not Esql.prompt_text like "*ghp_example*" and
        not Esql.prompt_text like "*sk-ant-api03-test*" and
        (

        Esql.prompt_text rlike """.*(AKIA|ASIA)[A-Z0-9]{16}.*""" or
        Esql.prompt_text rlike """.*gh[pousr]_[A-Za-z0-9]{36}.*""" or
        Esql.prompt_text rlike """.*github_pat_[A-Za-z0-9_]+.*""" or
        Esql.prompt_text rlike """.*-----BEGIN [A-Z ]*PRIVATE KEY-----.*""" or
        Esql.prompt_text rlike """.*xox[baprs]-[0-9]+-[0-9]+-[A-Za-z0-9]+.*""" or
        Esql.prompt_text rlike """.*sk_live_[A-Za-z0-9]+.*""" or
        Esql.prompt_text rlike """.*AIza[-A-Za-z0-9_]+.*""" or
        Esql.prompt_text rlike """.*npm_[A-Za-z0-9]{36}.*""" or
        Esql.prompt_text rlike """.*sk-ant-[A-Za-z0-9-]+.*""" or
        Esql.prompt_text rlike """.*sk-[A-Za-z0-9]{20,}.*""" or
        Esql.prompt_text rlike """.*hvs[.][A-Za-z0-9]+.*""" or
        Esql.prompt_text rlike """.*dckr_pat_[-A-Za-z0-9_]+.*""" or
        Esql.prompt_text rlike """.*SG[.][-A-Za-z0-9_]+[.][-A-Za-z0-9_]+.*""" or
        Esql.prompt_text rlike """.*(AccountKey=|SharedAccessKey=)[-A-Za-z0-9+/=]+.*""" or
        Esql.prompt_text rlike """.*eyJ[-A-Za-z0-9_]+[.]eyJ[-A-Za-z0-9_]+[.][-A-Za-z0-9_]+.*"""
        )
    )
        or
        (
        Esql.response_text is not null and
        Esql.response_text != "" and
        not Esql.response_text like "*AKIAIOSFODNN7EXAMPLE*" and
        not Esql.response_text like "*ASIAIOSFODNN7EXAMPLE*" and
        not Esql.response_text like "*ghp_example*" and
        not Esql.response_text like "*sk-ant-api03-test*" and
        (

        Esql.response_text rlike """.*(AKIA|ASIA)[A-Z0-9]{16}.*""" or
        Esql.response_text rlike """.*gh[pousr]_[A-Za-z0-9]{36}.*""" or
        Esql.response_text rlike """.*github_pat_[A-Za-z0-9_]+.*""" or
        Esql.response_text rlike """.*-----BEGIN [A-Z ]*PRIVATE KEY-----.*""" or
        Esql.response_text rlike """.*xox[baprs]-[0-9]+-[0-9]+-[A-Za-z0-9]+.*""" or
        Esql.response_text rlike """.*sk_live_[A-Za-z0-9]+.*""" or
        Esql.response_text rlike """.*AIza[-A-Za-z0-9_]+.*""" or
        Esql.response_text rlike """.*npm_[A-Za-z0-9]{36}.*""" or
        Esql.response_text rlike """.*sk-ant-[A-Za-z0-9-]+.*""" or
        Esql.response_text rlike """.*sk-[A-Za-z0-9]{20,}.*""" or
        Esql.response_text rlike """.*hvs[.][A-Za-z0-9]+.*""" or
        Esql.response_text rlike """.*dckr_pat_[-A-Za-z0-9_]+.*""" or
        Esql.response_text rlike """.*SG[.][-A-Za-z0-9_]+[.][-A-Za-z0-9_]+.*""" or
        Esql.response_text rlike """.*(AccountKey=|SharedAccessKey=)[-A-Za-z0-9+/=]+.*""" or
        Esql.response_text rlike """.*eyJ[-A-Za-z0-9_]+[.]eyJ[-A-Za-z0-9_]+[.][-A-Za-z0-9_]+.*"""
        )
    )
    )
| keep
    _id, _version, _index, @timestamp, event.action, user.id, user.email,
    openai_chatgpt_enterprise.codex_log.client_id,
    openai_chatgpt_enterprise.codex_log.event_details.session_id,
    openai_chatgpt_enterprise.codex_log.event_details.prompt_text,
    openai_chatgpt_enterprise.codex_log.event_details.response_text,
    gen_ai.request.model, data_stream.*