OpenAI ChatGPT Enterprise Unusual Codex MCP Tool Call

  1[metadata]
  2creation_date = "2026/10/06"
  3integration = ["openai_chatgpt_enterprise"]
  4maturity = "production"
  5updated_date = "2026/10/06"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects the first ChatGPT Enterprise Codex MCP tool name used by a given user email within an organization in the
 11rule history window. Codex MCP tools can query external systems and pull organizational data into an agent session.
 12Alerting on first-seen organization, user, and tool triples highlights new or unexpected connector usage rather than
 13every routine approved tool call.
 14"""
 15false_positives = [
 16    """
 17    Engineers enable approved Codex MCP connectors for GitHub, Slack, ticketing, and internal tools during normal
 18    development. Validate the tool name, connector, and whether the integration matches an approved workflow.
 19    """,
 20]
 21from = "now-9m"
 22index = ["logs-openai_chatgpt_enterprise.codex_log-*"]
 23language = "kuery"
 24license = "Elastic License v2"
 25name = "OpenAI ChatGPT Enterprise Unusual Codex MCP Tool Call"
 26note = """## Triage and analysis
 27
 28### Investigating OpenAI ChatGPT Enterprise Unusual Codex MCP Tool Call
 29
 30First-seen Codex MCP tool name for this `organization.id` and `user.email` within the rule history window. MCP tools can move organizational
 31data into external systems through Codex.
 32
 33Escalate when the tool or connector is not on the approved inventory, the actor is unexpected, or the same session also
 34shows credential exposure, broad file access, or unusual shares. Close as a false positive when the tool is approved
 35for that user or team.
 36
 37#### Possible investigation steps
 38
 39- Record `gen_ai.tool.name`, connector or resource identifiers, and the user (`user.email` / `user.id`).
 40- Confirm whether the MCP connector is approved in your ChatGPT Enterprise workspace inventory.
 41- Review nearby Codex events for the same session for additional tool calls, prompts containing secrets, or
 42  access-token creation.
 43- Search for the same tool used by other users to distinguish a new org-wide rollout from a single anomalous account.
 44
 45### False positive analysis
 46
 47- Approved engineering automation commonly introduces first-seen tool names during connector rollouts and pilot work.
 48
 49### Response and remediation
 50
 51- Disable unauthorized connectors, revoke related credentials, and review data returned into the Codex session.
 52- If sensitive data was retrieved, treat the session as a potential exposure and follow your data-incident process.
 53"""
 54references = [
 55    "https://www.elastic.co/docs/reference/integrations/openai_chatgpt_enterprise",
 56    "https://platform.openai.com/docs/compliance",
 57]
 58risk_score = 47
 59rule_id = "2b284f6d-5307-4f42-968a-0769005c740e"
 60setup = """## Setup
 61
 62This rule requires the OpenAI ChatGPT Enterprise integration to collect compliance logs into Elasticsearch.
 63
 64https://www.elastic.co/docs/reference/integrations/openai_chatgpt_enterprise
 65"""
 66severity = "medium"
 67tags = [
 68    "Domain: GenAI",
 69    "Platform: OpenAI",
 70    "Data Source: OpenAI ChatGPT Enterprise",
 71    "Service: OpenAI ChatGPT Enterprise",
 72    "Use Case: Threat Detection",
 73    "Use Case: UEBA",
 74    "Resources: Investigation Guide",
 75    "Rule Type: New Terms",
 76    "Tactic: Collection",
 77    "Mitre Atlas: AML.T0085",
 78]
 79timestamp_override = "event.ingested"
 80type = "new_terms"
 81
 82query = '''
 83data_stream.dataset: "openai_chatgpt_enterprise.codex_log" and
 84    event.action: "app_mcp_call" and
 85    organization.id: * and
 86    user.email: * and
 87    gen_ai.tool.name: *
 88'''
 89
 90
 91[[rule.threat]]
 92framework = "MITRE ATT&CK"
 93[[rule.threat.technique]]
 94id = "T1213"
 95name = "Data from Information Repositories"
 96reference = "https://attack.mitre.org/techniques/T1213/"
 97
 98
 99[rule.threat.tactic]
100id = "TA0009"
101name = "Collection"
102reference = "https://attack.mitre.org/tactics/TA0009/"
103
104[[rule.threat_mappings]]
105framework = "MITRE ATLAS"
106version = "2026.08"
107[[rule.threat_mappings.threat]]
108framework = "MITRE ATLAS"
109[[rule.threat_mappings.threat.technique]]
110id = "AML.T0085"
111name = "Data from AI Services"
112reference = "https://atlas.mitre.org/techniques/AML.T0085/"
113
114
115[rule.threat_mappings.threat.tactic]
116id = "AML.TA0009"
117name = "Collection"
118reference = "https://atlas.mitre.org/tactics/AML.TA0009/"
119
120[rule.investigation_fields]
121field_names = [
122    "@timestamp",
123    "organization.id",
124    "user.id",
125    "user.email",
126    "gen_ai.tool.name",
127    "openai_chatgpt_enterprise.codex_log.event_details.tool_meta.connector_id",
128    "openai_chatgpt_enterprise.codex_log.event_details.tool_meta.resource_id",
129    "openai_chatgpt_enterprise.codex_log.client_id",
130]
131
132[rule.new_terms]
133field = "new_terms_fields"
134value = ["organization.id", "user.email", "gen_ai.tool.name"]
135[[rule.new_terms.history_window_start]]
136field = "history_window_start"
137value = "now-14d"