Detection rule for Microsoft Foundry jailbreak attempts via Azure API Management. It watches Foundry GatewayLogs for jailbreak indicators in the backend response and prompt, flagging two scenarios: (1) a blocked call where error.innererror.content_filter_result.jailbreak.detected is true and the backend response code is 400, and (2) an allowed-through call where prompt_filter_results.content_filter_results.jailbreak.detected is true and the backend response code is 200. The alert includes caller and target context (source IP, user agent, apim_subscription_id, API/model path), the request/response bodies (prompt and model reply), and the jailbreak indicators. The rule maps to MITRE ATT&CK T1562 Defense Evasion and MITRE ATLAS AML.T0051 LLM Prompt Injection and AML.T0054 LLM Jailbreak. It requires the Azure Foundry integration with GatewayLogs and backend response body logging for triage. False positives include red-team tests using jailbreak prompts; exclusions may apply. Remediation guidance includes rotating API keys for unauthorized sources, tightening content filters, and adjusting filter mode to block jailbreak prompts when needed.