OpenAI ChatGPT Enterprise Conversation Message Containing Credentials

  1[metadata]
  2creation_date = "2026/10/06"
  3integration = ["openai_chatgpt_enterprise"]
  4maturity = "production"
  5updated_date = "2026/10/16"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects ChatGPT Enterprise conversation messages whose text matches known credential patterns (cloud keys, GitHub
 11tokens, private keys, Slack/SendGrid tokens, Stripe/OpenAI/Anthropic keys, Vault/Docker tokens, JWTs, or Azure storage
 12keys). Secrets pasted into chats can be retained in compliance logs and model context.
 13"""
 14false_positives = [
 15    "Documentation samples and example keys can match token patterns. Confirm the value is live before rotating it.",
 16    "Approved prompt-security or DLP validation tests may intentionally submit synthetic secrets.",
 17]
 18from = "now-9m"
 19language = "esql"
 20license = "Elastic License v2"
 21name = "OpenAI ChatGPT Enterprise Conversation Message Containing Credentials"
 22note = """## Triage and analysis
 23
 24### Investigating OpenAI ChatGPT Enterprise Conversation Message Containing Credentials
 25
 26A conversation message matched a known credential pattern. Secrets pasted into ChatGPT can be retained in compliance logs and model context, and may later appear in shares or exports.
 27
 28Escalate when the value appears live, when the conversation is shared externally, or when downloads follow the message. Close as a false positive for clearly synthetic or documentation examples.
 29
 30#### Possible investigation steps
 31
 32- Read `message` on the alert and decide whether the match is a live secret, an example key, or incidental text.
 33- Identify the user and conversation (`openai_chatgpt_enterprise.conversation_message.conversation.id` / title).
 34- Look for nearby conversation shares, file downloads, or Codex activity from the same user.
 35- Check whether the conversation was shared outside the intended audience after the message time.
 36
 37### False positive analysis
 38
 39- Documentation samples and intentional prompt-security tests can match token patterns. Confirm the value is live before rotating it.
 40
 41### Response and remediation
 42
 43- If the credential is live, rotate or revoke it and remove residual copies from shared conversations where possible.
 44- Review subsequent shares and downloads for the same conversation.
 45- Limit access to alerts and compliance logs that retain message text.
 46"""
 47references = [
 48    "https://www.elastic.co/docs/reference/integrations/openai_chatgpt_enterprise",
 49    "https://platform.openai.com/docs/compliance",
 50]
 51risk_score = 73
 52rule_id = "231c2ade-69c8-4415-b710-0c56f5f07e95"
 53setup = """## Setup
 54
 55This rule requires the OpenAI ChatGPT Enterprise integration to collect compliance logs into Elasticsearch.
 56
 57https://www.elastic.co/docs/reference/integrations/openai_chatgpt_enterprise
 58"""
 59severity = "high"
 60tags = [
 61    "Domain: GenAI",
 62    "Platform: OpenAI",
 63    "Data Source: OpenAI ChatGPT Enterprise",
 64    "Service: OpenAI ChatGPT Enterprise",
 65    "Use Case: Threat Detection",
 66    "Resources: Investigation Guide",
 67    "Rule Type: ES|QL",
 68    "Tactic: Credential Access",
 69    "Mitre Atlas: AML.T0055",
 70    "Mitre Atlas: AML.T0057",
 71]
 72timestamp_override = "event.ingested"
 73type = "esql"
 74
 75query = '''
 76from logs-openai_chatgpt_enterprise.conversation_message-* metadata _id, _version, _index
 77| eval Esql.message_text = coalesce(message, "")
 78| where
 79    data_stream.dataset == "openai_chatgpt_enterprise.conversation_message" and
 80    Esql.message_text is not null and
 81    Esql.message_text != "" and
 82    not Esql.message_text like "*AKIAIOSFODNN7EXAMPLE*" and
 83    not Esql.message_text like "*ASIAIOSFODNN7EXAMPLE*" and
 84    not Esql.message_text like "*ghp_example*" and
 85    not Esql.message_text like "*sk-ant-api03-test*" and
 86    (
 87        Esql.message_text rlike """.*(AKIA|ASIA)[A-Z0-9]{16}.*""" or
 88        Esql.message_text rlike """.*gh[pousr]_[A-Za-z0-9]{36}.*""" or
 89        Esql.message_text rlike """.*github_pat_[A-Za-z0-9_]+.*""" or
 90        Esql.message_text rlike """.*-----BEGIN [A-Z ]*PRIVATE KEY-----.*""" or
 91        Esql.message_text rlike """.*xox[baprs]-[0-9]+-[0-9]+-[A-Za-z0-9]+.*""" or
 92        Esql.message_text rlike """.*sk_live_[A-Za-z0-9]+.*""" or
 93        Esql.message_text rlike """.*AIza[-A-Za-z0-9_]+.*""" or
 94        Esql.message_text rlike """.*npm_[A-Za-z0-9]{36}.*""" or
 95        Esql.message_text rlike """.*sk-ant-[A-Za-z0-9-]+.*""" or
 96        Esql.message_text rlike """.*sk-[A-Za-z0-9]{20,}.*""" or
 97        Esql.message_text rlike """.*hvs[.][A-Za-z0-9]+.*""" or
 98        Esql.message_text rlike """.*dckr_pat_[-A-Za-z0-9_]+.*""" or
 99        Esql.message_text rlike """.*SG[.][-A-Za-z0-9_]+[.][-A-Za-z0-9_]+.*""" or
100        Esql.message_text rlike """.*(AccountKey=|SharedAccessKey=)[-A-Za-z0-9+/=]+.*""" or
101        Esql.message_text rlike """.*eyJ[-A-Za-z0-9_]+[.]eyJ[-A-Za-z0-9_]+[.][-A-Za-z0-9_]+.*"""
102    )
103| keep
104    _id, _version, _index, @timestamp, message, user.id, user.email,
105    openai_chatgpt_enterprise.conversation_message.conversation.id,
106    openai_chatgpt_enterprise.conversation_message.conversation.title,
107    openai_chatgpt_enterprise.conversation_message.message.author.type,
108    openai_chatgpt_enterprise.conversation_message.message.id,
109    data_stream.*
110'''
111
112
113[[rule.threat]]
114framework = "MITRE ATT&CK"
115[[rule.threat.technique]]
116id = "T1552"
117name = "Unsecured Credentials"
118reference = "https://attack.mitre.org/techniques/T1552/"
119
120
121[rule.threat.tactic]
122id = "TA0006"
123name = "Credential Access"
124reference = "https://attack.mitre.org/tactics/TA0006/"
125[[rule.threat_mappings]]
126framework = "MITRE ATLAS"
127version = "2026.08"
128[[rule.threat_mappings.threat]]
129framework = "MITRE ATLAS"
130[[rule.threat_mappings.threat.technique]]
131id = "AML.T0057"
132name = "LLM Data Leakage"
133reference = "https://atlas.mitre.org/techniques/AML.T0057/"
134
135
136[rule.threat_mappings.threat.tactic]
137id = "AML.TA0010"
138name = "Exfiltration"
139reference = "https://atlas.mitre.org/tactics/AML.TA0010/"
140[[rule.threat_mappings.threat]]
141framework = "MITRE ATLAS"
142[[rule.threat_mappings.threat.technique]]
143id = "AML.T0055"
144name = "Unsecured Credentials"
145reference = "https://atlas.mitre.org/techniques/AML.T0055/"
146
147
148[rule.threat_mappings.threat.tactic]
149id = "AML.TA0013"
150name = "Credential Access"
151reference = "https://atlas.mitre.org/tactics/AML.TA0013/"
152
153[rule.investigation_fields]
154field_names = [
155    "@timestamp",
156    "user.id",
157    "user.email",
158    "message",
159    "openai_chatgpt_enterprise.conversation_message.conversation.id",
160    "openai_chatgpt_enterprise.conversation_message.conversation.title",
161]