[New Integration] Kong AI Gateway

### Description

Kong AI Gateway is a set of AI plugins on Kong Gateway / Konnect that broker LLM traffic to every model provider (OpenAI, Anthropic, Azure OpenAI, Bedrock, Cohere, Mistral, Ollama, Vertex, self-hosted). Because all model traffic flows through it, the Kong AI Gateway is a single **choke point** for AI security: it sees the prompts, the responses, the identity behind each call, the cost — and, critically, the **guardrail verdicts** (prompt-injection, PII, content-safety) applied to each request.

Kong AI Gateway telemetry provides gateway-level threat detection, sensitive-data visibility, and credential/audit governance for AI access. Kong already emits everything needed via its standard logging, metrics, and audit channels, so the build is mappings + dashboards + docs on top of existing egress paths.

### What this data gives you

Kong AI Gateway exposes a few security-relevant event groups:

**1. AI request/response activity — per LLM call:**
- **Identity & attribution** — the authenticated consumer, credential used, and client source IP.
- **Model & provider** — which provider and model the request was routed to (incl. requested vs. actually-served model).
- **Cost & usage** — prompt / completion / total tokens, cost, cache hit/miss, latency.
- **Outcome** — success/failure and error detail.
- **Content** — the prompt and response text (optional; off unless explicitly enabled).

**2. AI security & guardrail verdicts — the AI-attack signal:**
- **Content safety / moderation** — blocks from Azure Content Safety, AWS Bedrock Guardrails, GCP Model Armor, Lakera (with block reason and the faulty prompt/response).
- **Prompt-injection / prompt-guard** — allowed vs. blocked prompts.
- **PII detection & redaction** — entities identified and sanitized in the request/response.
- This is the layer no other source provides — actual prompt-injection / PII / content-safety detections at the choke point.

**3. Abuse & rate-limit signals:**
- Token-aware rate-limit and quota rejections (429s) per consumer / model / provider.

**4. Authentication & control-plane audit:**
- Gateway auth failures (unauthorized / rejected requests).
- Admin/config audit — changes to keys, plugins, routes, services, and consumers, with the actor (who changed what).

### Scope & data boundaries

- **New integration:** `kong_ai_gateway`, scoped to the **AI Gateway** (not the traditional API-gateway proxy).
- **Telemetry spans logs, metrics, and audit channels.**
- **Content is redactable.** Prompt/response text and raw PII appear only when the operator explicitly enables payload/content logging - default posture should be redact-aware.
- **Tiering:** the AI proxy and base logging are open-source, but the security plugins (prompt-guard, PII sanitizer, content-safety, advanced rate limiting) and audit logging are **Kong Enterprise / Konnect** features. The integration should treat the security/audit streams as conditional on those being licensed and enabled.

### Why this matters

- **Gateway-level threat detection (the headline):** guardrail / prompt-injection / PII / content-safety verdicts on live traffic — ready-made AI-attack signal that correlates with the rest of the SOC's telemetry. Nothing else in the catalog provides this today.
- **Vendor-neutral, shadow-model visibility:** every model call routes through Kong, so one integration sees usage across *all* providers — including unsanctioned models and direct-to-provider attempts.
- **Sensitive-data visibility:** detect PII or secrets in prompts at the single point all AI traffic crosses, and correlate with exfiltration signals in Elastic Security.
- **AI credential & access governance:** audit events and consumer attribution give the access-control history for who can invoke which models.
- **Abuse & anomaly detection:** token/cost/volume per consumer/model and rate-limit rejections flag compromised keys, automation abuse, or data staging.
- **Threat correlation:** join gateway events to identity, endpoint, and cloud signals by consumer/IP/time.

### What needs to be built

New integration: `kong_ai_gateway`

- **Coverage** for the event groups above: AI request/response activity, AI security & guardrail verdicts, abuse/rate-limit signals, and authentication/control-plane audit.
- **Field mappings (ECS-aligned):** identity → `user.*`, source IP → `source.ip`, outcome/status → `event.*` / `http.response.status_code`; model/provider/token/cost as custom AI fields; guardrail and PII verdicts surfaced as security events with `event.category`/`event.outcome`.
- **Dashboards:** AI security/threat overview (prompt-injection, PII, content-safety hits by consumer/model), traffic by model/provider, top consumers by volume and cost, and a config/audit timeline.
- **Detections:** starter rules for guardrail/content-safety blocks, prompt-guard rejection spikes, rate-limit (429) bursts, and unauthorized config changes.

### Sample event

> ⚠️ **Illustrative sample.** Field names follow Kong's AI audit log reference; values are representative and the guardrail sub-structure should be confirmed against a live event during development.

```json
{
"client_ip": "203.0.113.42",
"consumer": { "id": "c-7f3a", "username": "data-science-team" },
"route": { "name": "ai-chat" },
"service": { "name": "openai-proxy" },
"request": { "method": "POST", "uri": "/chat/completions" },
"response": { "status": 200 },
"ai": {
"proxy": {
"meta": { "request_model": "gpt-4o", "response_model": "gpt-4o", "provider_name": "openai" },
"usage": { "prompt_tokens": 512, "completion_tokens": 188, "total_tokens": 700, "cost": 0.01234 },
"azure-content-safety": { "input_block_reason": null },
"lakera-guard": { "input_block_detail": [] }
},
"sanitizer": {
"pii_identified": 2,
"pii_sanitized": 2,
"sanitized_items": [ { "entity_type": "EMAIL_ADDRESS" }, { "entity_type": "CREDIT_CARD" } ]
}
}
}
```

**Key fields**

| Field | Description |
|---|---|
| `consumer.username` / `consumer.id` | Identity behind the call |
| `client_ip` | Client source IP — correlation key |
| `ai.proxy.meta.request_model` / `provider_name` | Which provider/model was invoked (incl. shadow usage) |
| `ai.proxy.usage.total_tokens` / `cost` | Spend and volume — abuse/anomaly signal |
| `ai.proxy..input_block_reason` | Content-safety / prompt-injection verdict |
| `ai.sanitizer.pii_identified` / `pii_sanitized` | PII detected and redacted in the request |
| `response.status` | Outcome (200 / 4xx block / 429 rate limit) |

> Availability note: prompt/response content appears only when payload logging is enabled. Guardrail and PII fields appear only for requests where those plugins run. Security plugins and audit logging are Kong Enterprise / Konnect features.

### Access requirements

A self-hosted **Kong AI Gateway** with the AI proxy and a logging plugin enabled. The AI security signals (guardrails, PII sanitizer, content-safety, advanced rate limiting) and audit logs require Kong **Enterprise / Konnect**. Development requires a running gateway with at least one provider and at least one guardrail/PII plugin configured to validate the security mappings.

### References

- [Kong AI Gateway overview](https://developer.konghq.com/index/ai-gateway/)
- [AI audit log field reference](https://developer.konghq.com/ai-gateway/ai-audit-log-reference/)
- [AI LLM metrics](https://developer.konghq.com/ai-gateway/monitor-ai-llm-metrics/)
- [AI Prompt Guard](https://developer.konghq.com/plugins/ai-prompt-guard/) · [AI Sanitizer (PII)](https://developer.konghq.com/plugins/ai-sanitizer/)
- [Konnect audit logs](https://developer.konghq.com/konnect-platform/audit-logs/) · [Gateway audit logs](https://developer.konghq.com/gateway/audit-logs/)

Start with the AI audit log field reference and the illustrative sample event, then validate the guardrail and PII structures against a running Kong AI Gateway with logging and security plugins enabled. Map the four requested event groups, dashboards, and starter detections, and confirm coverage for AI activity, security verdicts, rate limits, and audit changes.

Written by the indexing model from the issue text.