This rule detects high-confidence prompt injection in GenAI user messages by leveraging a security_ai classifier and a downstream ES|QL post-analysis step. A high-scoring signal (probability > 0.98) from any of four sub-models (instruction_override, encoding, word_obfuscation, or hash_string) triggers a deeper review. The ES|QL query aggregates cloud GenAI logs (AWS Bedrock and OpenAI ChatGPT Enterprise) and constructs Esql.prompt_body from relevant content fields (gen_ai.input.messages content.text, content.guardContent.text, and parts.content). If the full prompt body is too long, an excerpt is built from the sub-model contexts. The completion stage calls a dedicated inference endpoint (.google-gemini-3.8-flash-completion) to produce a verdict (TP/FP/SUSPICIOUS), a confidence, and a short summary; only verdicts of TP with confidence >= 0.9 generate an alert. The rule then surfaces triage data including prompt_body, full text, and security_ai/gen_ai/openai_bedrock/openai_chatgpt_enterprise fields to aid investigation. False positives discussed include benign decoding exercises and commits (e.g., base64 samples, git SHAs); investigators should compare the excerpt and raw user prompt to determine if the case is a known benign example. Remediation guidance covers revoking sessions, reviewing assistant responses, or adding exceptions for benign contexts. The rule is mapped to MITRE ATLAS AML.T0051 (LLM Prompt Injection) and AML.T0054 (LLM Jailbreak) with Execution and Defense Evasion tacitcs, respectively. Operationally, it runs from now-10m with a 5-minute interval, requiring the security_ai Fleet integration and a completion endpoint (inference_id: .google-gemini-3.8-flash-completion). The rule’s risk_score is 73 and its severity is high, reflecting the potential impact of jailbreak or prompt-injection exploitation in GenAI workloads.