A security team is responding to an incident where an attacker has stolen an Azure OpenAI API key and is making unauthorized API calls. The team has already regenerated the key. However, they need to understand what was done with the stolen key. Which data source provides the most detailed forensic information about the API calls made using the compromised key?

B is correct because Azure OpenAI diagnostic logs captured in the AzureDiagnostics table contain detailed data plane information about each API call including the timestamp, caller IP, request type, model deployment used, token counts, and can include prompt/completion content if logging is enabled. This provides the most comprehensive forensic view of what was done with the compromised key. A is incorrect because Azure Activity Logs capture control plane operations (creating resources, modifying settings, regenerating keys) but not data plane API calls for inference requests. C is incorrect because Defender for AI alerts show flagged suspicious activity but not a complete record of all API calls made with the compromised key. D is incorrect because Azure Monitor metrics provide aggregate statistics (total request counts, token consumption) but not per-request forensic detail including caller information and request content.