OpenAI ChatGPT Enterprise Excessive Conversation Deletion

  1[metadata]
  2creation_date = "2026/10/06"
  3integration = ["openai_chatgpt_enterprise"]
  4maturity = "production"
  5updated_date = "2026/10/09"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects an unusually high number of ChatGPT Enterprise conversation deletion events for the same user within a rolling
 1124-hour lookback. Mass deletion can indicate an attempt to remove conversation history or cover tracks after misuse.
 12"""
 13false_positives = ["Users purging old chats during workspace hygiene or retention cleanup."]
 14from = "now-24h"
 15interval = "1h"
 16language = "esql"
 17license = "Elastic License v2"
 18name = "OpenAI ChatGPT Enterprise Excessive Conversation Deletion"
 19note = """## Triage and analysis
 20
 21### Investigating OpenAI ChatGPT Enterprise Excessive Conversation Deletion
 22
 23One user deleted a large number of conversations in a rolling 24-hour window. Mass deletion can remove useful
 24investigative context after misuse or data staging.
 25
 26Escalate when deletions follow downloads, shares, or credential-bearing prompts, or when the user has no retention-cleanup role. Close as a false positive for documented retention cleanup or migration tooling.
 27
 28#### Possible investigation steps
 29
 30- Capture conversation identifiers from the alert while they remain in audit history.
 31- Review `Esql.event_count` and the time window for the user.
 32- Compare with preceding file downloads, conversation shares, or prompts containing secrets from the same user.
 33- Confirm whether a retention or migration process accounts for the volume.
 34
 35### False positive analysis
 36
 37- Approved retention cleanup jobs and workspace migration tooling can delete many conversations in a short period.
 38
 39### Response and remediation
 40
 41- Preserve remaining audit exports, revoke sessions if the activity appears malicious, and investigate prior data access by the same user.
 42"""
 43references = [
 44    "https://www.elastic.co/docs/reference/integrations/openai_chatgpt_enterprise",
 45    "https://platform.openai.com/docs/compliance",
 46]
 47risk_score = 47
 48rule_id = "ac16af6b-8a45-43cd-92bc-83b2fa0e1e3a"
 49setup = """## Setup
 50
 51This rule requires the OpenAI ChatGPT Enterprise integration to collect compliance logs into Elasticsearch.
 52
 53https://www.elastic.co/docs/reference/integrations/openai_chatgpt_enterprise
 54"""
 55severity = "medium"
 56tags = [
 57    "Domain: GenAI",
 58    "Platform: OpenAI",
 59    "Data Source: OpenAI ChatGPT Enterprise",
 60    "Service: OpenAI ChatGPT Enterprise",
 61    "Use Case: Threat Detection",
 62    "Resources: Investigation Guide",
 63    "Rule Type: ES|QL",
 64    "Use Case: UEBA",
 65    "Tactic: Defense Evasion",
 66    "Mitre Atlas: AML.T0092",
 67]
 68timestamp_override = "event.ingested"
 69type = "esql"
 70
 71query = '''
 72from logs-openai_chatgpt_enterprise.audit_log-*
 73| where
 74    data_stream.dataset == "openai_chatgpt_enterprise.audit_log" and
 75    event.action == "conversation_delete" and
 76    user.id is not null
 77| stats
 78    Esql.event_count = count(*),
 79    Esql.conversation_id_values = values(openai_chatgpt_enterprise.audit_log.action_data.conversation_id),
 80    Esql.source_ip_values = values(source.ip),
 81    Esql.timestamp_first_seen = min(@timestamp),
 82    Esql.timestamp_last_seen = max(@timestamp)
 83  by user.id, user.email
 84| where Esql.event_count >= 20
 85| keep user.id, user.email, Esql.*
 86'''
 87
 88
 89[[rule.threat]]
 90framework = "MITRE ATT&CK"
 91[[rule.threat.technique]]
 92id = "T1070"
 93name = "Indicator Removal"
 94reference = "https://attack.mitre.org/techniques/T1070/"
 95
 96
 97[rule.threat.tactic]
 98id = "TA0005"
 99name = "Defense Evasion"
100reference = "https://attack.mitre.org/tactics/TA0005/"
101[[rule.threat_mappings]]
102framework = "MITRE ATLAS"
103version = "2026.08"
104[[rule.threat_mappings.threat]]
105framework = "MITRE ATLAS"
106[[rule.threat_mappings.threat.technique]]
107id = "AML.T0092"
108name = "Manipulate User LLM Chat History"
109reference = "https://atlas.mitre.org/techniques/AML.T0092/"
110
111
112[rule.threat_mappings.threat.tactic]
113id = "AML.TA0007"
114name = "Defense Evasion"
115reference = "https://atlas.mitre.org/tactics/AML.TA0007/"
116
117[rule.alert_suppression]
118group_by = ["user.id"]
119missing_fields_strategy = "suppress"
120
121[rule.investigation_fields]
122field_names = [
123    "user.id",
124    "user.email",
125    "Esql.event_count",
126    "Esql.conversation_id_values",
127    "Esql.source_ip_values",
128    "Esql.timestamp_first_seen",
129    "Esql.timestamp_last_seen",
130]
131
132[rule.alert_suppression.duration]
133unit = "h"
134value = 24