OpenAI ChatGPT Enterprise Unusual MCP App Activity

  1[metadata]
  2creation_date = "2026/10/06"
  3integration = ["openai_chatgpt_enterprise"]
  4maturity = "production"
  5updated_date = "2026/10/06"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects the first time a ChatGPT Enterprise MCP app name is used by a given user email within an organization in the rule
 11history window. MCP apps connect ChatGPT to external systems and can move organizational data into third-party tools.
 12Alerting on first-seen organization, user, and app id triples highlights new or unexpected connector usage rather than
 13every routine approved MCP request. App name is still required in the query for investigation context.
 14"""
 15false_positives = [
 16    """
 17    Approved MCP apps such as Slack or ticketing connectors generate routine traffic during normal work. First-seen
 18    alerts are common during onboarding when a user first uses an approved app.
 19    """,
 20]
 21from = "now-9m"
 22index = ["logs-openai_chatgpt_enterprise.app_log-*"]
 23language = "kuery"
 24license = "Elastic License v2"
 25name = "OpenAI ChatGPT Enterprise Unusual MCP App Activity"
 26note = """## Triage and analysis
 27
 28### Investigating OpenAI ChatGPT Enterprise Unusual MCP App Activity
 29
 30First-seen MCP app name for this `organization.id` and `user.email` within the rule history window. MCP apps can move organizational data
 31into third-party tools.
 32
 33Escalate when the app is not in the approved inventory, the query looks like bulk data access, or the user recently
 34had suspicious authentication activity. Close as a false positive when the app is approved for that user.
 35
 36#### Possible investigation steps
 37
 38- Identify the user and app (`openai_chatgpt_enterprise.app_log.app_name`, `app_id`).
 39- Review `openai_chatgpt_enterprise.app_log.query` and conversation identifiers when present.
 40- Confirm whether the app is approved for the workspace and whether OAuth links for that app are expected.
 41- Correlate with app-auth link events, conversation shares, or file downloads from the same user nearby.
 42
 43### False positive analysis
 44
 45- Approved MCP apps generate routine request logs. First-seen alerts often reflect a user adopting an already-approved
 46  connector.
 47
 48### Response and remediation
 49
 50- Disable unauthorized MCP apps, revoke linked credentials, and review conversation context for sensitive data
 51  exposure.
 52"""
 53references = [
 54    "https://www.elastic.co/docs/reference/integrations/openai_chatgpt_enterprise",
 55    "https://platform.openai.com/docs/compliance",
 56]
 57risk_score = 47
 58rule_id = "05b8a893-4683-450f-984d-7b52ca2aa4dd"
 59setup = """## Setup
 60
 61This rule requires the OpenAI ChatGPT Enterprise integration to collect compliance logs into Elasticsearch.
 62
 63https://www.elastic.co/docs/reference/integrations/openai_chatgpt_enterprise
 64"""
 65severity = "medium"
 66tags = [
 67    "Domain: GenAI",
 68    "Platform: OpenAI",
 69    "Data Source: OpenAI ChatGPT Enterprise",
 70    "Service: OpenAI ChatGPT Enterprise",
 71    "Use Case: Threat Detection",
 72    "Use Case: UEBA",
 73    "Resources: Investigation Guide",
 74    "Rule Type: New Terms",
 75    "Tactic: Collection",
 76    "Mitre Atlas: AML.T0053",
 77]
 78timestamp_override = "event.ingested"
 79type = "new_terms"
 80
 81query = '''
 82data_stream.dataset: "openai_chatgpt_enterprise.app_log" and
 83    openai_chatgpt_enterprise.app_log.app_type: "MCP" and
 84    organization.id: * and
 85    user.email: * and
 86    openai_chatgpt_enterprise.app_log.app_name: * and
 87    openai_chatgpt_enterprise.app_log.app_id: *
 88'''
 89
 90
 91[[rule.threat]]
 92framework = "MITRE ATT&CK"
 93[[rule.threat.technique]]
 94id = "T1213"
 95name = "Data from Information Repositories"
 96reference = "https://attack.mitre.org/techniques/T1213/"
 97
 98
 99[rule.threat.tactic]
100id = "TA0009"
101name = "Collection"
102reference = "https://attack.mitre.org/tactics/TA0009/"
103
104[[rule.threat_mappings]]
105framework = "MITRE ATLAS"
106version = "2026.08"
107[[rule.threat_mappings.threat]]
108framework = "MITRE ATLAS"
109[[rule.threat_mappings.threat.technique]]
110id = "AML.T0053"
111name = "AI Agent Tool Invocation"
112reference = "https://atlas.mitre.org/techniques/AML.T0053/"
113
114
115[rule.threat_mappings.threat.tactic]
116id = "AML.TA0005"
117name = "Execution"
118reference = "https://atlas.mitre.org/tactics/AML.TA0005/"
119
120[rule.investigation_fields]
121field_names = [
122    "@timestamp",
123    "organization.id",
124    "user.id",
125    "user.email",
126    "openai_chatgpt_enterprise.app_log.app_name",
127    "openai_chatgpt_enterprise.app_log.app_id",
128    "openai_chatgpt_enterprise.app_log.query",
129]
130
131[rule.new_terms]
132field = "new_terms_fields"
133value = ["organization.id", "user.email", "openai_chatgpt_enterprise.app_log.app_id"]
134[[rule.new_terms.history_window_start]]
135field = "history_window_start"
136value = "now-10d"