OpenAI ChatGPT Enterprise Slack Query Burst

  1[metadata]
  2creation_date = "2026/10/08"
  3integration = ["openai_chatgpt_enterprise"]
  4maturity = "production"
  5updated_date = "2026/10/09"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects a ChatGPT Enterprise user issuing ten or more distinct Slack app search queries in a five-minute bucket.
 11Adversaries who abuse a linked Slack connector after session compromise often run rapid multi-query searches across
 12channels and messages to locate sensitive content before collection or exfiltration.
 13"""
 14false_positives = [
 15    """
 16    Incident responders, support engineers, or community managers who run many Slack search refinements in a short
 17    window. Validate the query values and business context before escalating.
 18    """,
 19    """
 20    Approved automation that uses ChatGPT's Slack connector for triage or knowledge lookup. Raise the distinct-query
 21    threshold if those roles remain noisy.
 22    """,
 23]
 24from = "now-30m"
 25interval = "5m"
 26language = "esql"
 27license = "Elastic License v2"
 28name = "OpenAI ChatGPT Enterprise Slack Query Burst"
 29note = """## Triage and analysis
 30
 31### Investigating OpenAI ChatGPT Enterprise Slack Query Burst
 32
 33One user ran ten or more distinct Slack app searches in five minutes. That pattern can indicate using ChatGPT's Slack
 34connector to enumerate channels or messages at volume for collection.
 35
 36Escalate when queries look like bulk discovery (many channels, sequential refinements, sensitive keywords), downloads
 37or shares follow, or the actor is unexpected. Close as a false positive for approved incident-response or support
 38search bursts.
 39
 40#### Possible investigation steps
 41
 42- Review `Esql.query_values`, `Esql.query_count_distinct`, and `Esql.event_count` on the alert.
 43- Correlate with nearby conversation messages asking ChatGPT to search Slack or retrieve messages or files.
 44- Check subsequent file downloads, conversation shares, or Codex MCP Slack tool calls from the same user.
 45- Confirm whether the Slack connector is approved for that user and whether the search volume matches their role.
 46
 47### False positive analysis
 48
 49- Support and incident-response teams commonly refine Slack searches many times in one session.
 50- Raise `Esql.query_count_distinct` (default 10) above your baseline if heavy Slack-connector users remain noisy.
 51
 52### Response and remediation
 53
 54- If unauthorized, revoke Slack connector access for the user, review retrieved messages and files, and treat exposed
 55  content per your data-incident process.
 56- Hunt for follow-on downloads, shares, or external forwarding of the matched content.
 57"""
 58references = [
 59    "https://www.elastic.co/docs/reference/integrations/openai_chatgpt_enterprise",
 60    "https://platform.openai.com/docs/compliance",
 61]
 62risk_score = 47
 63rule_id = "b3785d4f-ce8a-4c36-bdd6-5e652d26a8ca"
 64setup = """## Setup
 65
 66This rule requires the OpenAI ChatGPT Enterprise integration to collect `app_log` events for the Slack app, including
 67request logs with `openai_chatgpt_enterprise.app_log.query` populated.
 68
 69https://www.elastic.co/docs/reference/integrations/openai_chatgpt_enterprise
 70"""
 71severity = "medium"
 72tags = [
 73    "Domain: GenAI",
 74    "Platform: OpenAI",
 75    "Data Source: OpenAI ChatGPT Enterprise",
 76    "Service: OpenAI ChatGPT Enterprise",
 77    "Use Case: Threat Detection",
 78    "Resources: Investigation Guide",
 79    "Rule Type: ES|QL",
 80    "Tactic: Collection",
 81    "Tactic: Discovery",
 82    "Mitre Atlas: AML.T0053",
 83    "Mitre Atlas: AML.T0085",
 84]
 85timestamp_override = "event.ingested"
 86type = "esql"
 87
 88query = '''
 89from logs-openai_chatgpt_enterprise.app_log-*
 90| where
 91    data_stream.dataset == "openai_chatgpt_enterprise.app_log" and
 92    openai_chatgpt_enterprise.app_log.app_name == "Slack" and
 93    openai_chatgpt_enterprise.app_log.log_type == "request" and
 94    openai_chatgpt_enterprise.app_log.query is not null and
 95    user.email is not null
 96| eval Esql.time_bucket = date_trunc(5 minutes, @timestamp)
 97| stats
 98    Esql.query_count_distinct = count_distinct(openai_chatgpt_enterprise.app_log.query),
 99    Esql.event_count = count(*),
100    Esql.query_values = values(openai_chatgpt_enterprise.app_log.query),
101    Esql.timestamp_first_seen = min(@timestamp),
102    Esql.timestamp_last_seen = max(@timestamp)
103  by
104    user.email,
105    organization.id,
106    Esql.time_bucket
107| where Esql.query_count_distinct >= 10
108| keep
109    user.email,
110    organization.id,
111    Esql.time_bucket,
112    Esql.query_count_distinct,
113    Esql.event_count,
114    Esql.query_values,
115    Esql.timestamp_first_seen,
116    Esql.timestamp_last_seen
117'''
118
119
120[[rule.threat]]
121framework = "MITRE ATT&CK"
122[[rule.threat.technique]]
123id = "T1213"
124name = "Data from Information Repositories"
125reference = "https://attack.mitre.org/techniques/T1213/"
126
127
128[rule.threat.tactic]
129id = "TA0009"
130name = "Collection"
131reference = "https://attack.mitre.org/tactics/TA0009/"
132[[rule.threat]]
133framework = "MITRE ATT&CK"
134[[rule.threat.technique]]
135id = "T1083"
136name = "File and Directory Discovery"
137reference = "https://attack.mitre.org/techniques/T1083/"
138
139
140[rule.threat.tactic]
141id = "TA0007"
142name = "Discovery"
143reference = "https://attack.mitre.org/tactics/TA0007/"
144[[rule.threat_mappings]]
145framework = "MITRE ATLAS"
146version = "2026.08"
147[[rule.threat_mappings.threat]]
148framework = "MITRE ATLAS"
149[[rule.threat_mappings.threat.technique]]
150id = "AML.T0053"
151name = "AI Agent Tool Invocation"
152reference = "https://atlas.mitre.org/techniques/AML.T0053/"
153
154
155[rule.threat_mappings.threat.tactic]
156id = "AML.TA0005"
157name = "Execution"
158reference = "https://atlas.mitre.org/tactics/AML.TA0005/"
159[[rule.threat_mappings.threat]]
160framework = "MITRE ATLAS"
161[[rule.threat_mappings.threat.technique]]
162id = "AML.T0085"
163name = "Data from AI Services"
164reference = "https://atlas.mitre.org/techniques/AML.T0085/"
165
166
167[rule.threat_mappings.threat.tactic]
168id = "AML.TA0009"
169name = "Collection"
170reference = "https://atlas.mitre.org/tactics/AML.TA0009/"
171
172[rule.alert_suppression]
173group_by = ["user.email", "organization.id", "Esql.time_bucket"]
174missing_fields_strategy = "suppress"
175
176[rule.investigation_fields]
177field_names = [
178    "user.email",
179    "organization.id",
180    "Esql.time_bucket",
181    "Esql.query_count_distinct",
182    "Esql.event_count",
183    "Esql.query_values",
184    "Esql.timestamp_first_seen",
185    "Esql.timestamp_last_seen",
186]
187
188[rule.alert_suppression.duration]
189unit = "h"
190value = 1