OpenAI ChatGPT Enterprise Memory Deleted

  1[metadata]
  2creation_date = "2026/10/06"
  3integration = ["openai_chatgpt_enterprise"]
  4maturity = "production"
  5updated_date = "2026/10/06"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects ChatGPT Enterprise audit events that delete stored memory. Adversaries may delete memory entries to remove
 11evidence of prior prompts, preferences, or staging instructions after misuse.
 12"""
 13false_positives = [
 14    "Users delete memories during privacy cleanup or troubleshooting.",
 15]
 16from = "now-9m"
 17language = "esql"
 18license = "Elastic License v2"
 19name = "OpenAI ChatGPT Enterprise Memory Deleted"
 20note = """## Triage and analysis
 21
 22### Investigating OpenAI ChatGPT Enterprise Memory Deleted
 23
 24A ChatGPT Enterprise memory entry was deleted. Memory deletion can remove persisted context that would otherwise help explain prior conversations or automated behavior.
 25
 26Escalate when deletion follows unusual chat activity, credential exposure, or other defense-evasion signals from the same user. Close as a false positive for routine user-driven memory cleanup.
 27
 28#### Possible investigation steps
 29
 30- Identify the user and memory identifiers on the alert.
 31- Review the user's recent conversation and Codex activity for sensitive content or policy-violating use.
 32- Correlate with mass conversation deletion, shares, or downloads nearby.
 33- Ask the user whether the deletion was intentional only after reviewing surrounding activity.
 34
 35### False positive analysis
 36
 37- Users commonly delete individual memories while managing personalization settings.
 38
 39### Response and remediation
 40
 41- Preserve remaining audit history and investigate the actor's recent conversations if the deletion appears tied to concealment.
 42"""
 43references = [
 44    "https://www.elastic.co/docs/reference/integrations/openai_chatgpt_enterprise",
 45    "https://platform.openai.com/docs/compliance",
 46]
 47risk_score = 47
 48rule_id = "c54f19db-fdea-4d32-9cc0-8f8b6016416e"
 49setup = """## Setup
 50
 51This rule requires the OpenAI ChatGPT Enterprise integration to collect compliance logs into Elasticsearch.
 52
 53https://www.elastic.co/docs/reference/integrations/openai_chatgpt_enterprise
 54"""
 55severity = "medium"
 56tags = [
 57    "Domain: GenAI",
 58    "Platform: OpenAI",
 59    "Data Source: OpenAI ChatGPT Enterprise",
 60    "Service: OpenAI ChatGPT Enterprise",
 61    "Use Case: Threat Detection",
 62    "Resources: Investigation Guide",
 63    "Rule Type: ES|QL",
 64    "Tactic: Defense Evasion",
 65    "Mitre Atlas: AML.T0092",
 66]
 67timestamp_override = "event.ingested"
 68type = "esql"
 69
 70query = '''
 71from logs-openai_chatgpt_enterprise.audit_log-* metadata _id, _version, _index
 72| where
 73    data_stream.dataset == "openai_chatgpt_enterprise.audit_log" and
 74    event.action == "delete_memory"
 75| keep
 76    _id, _version, _index, @timestamp, event.action, user.id, user.email, source.ip,
 77    openai_chatgpt_enterprise.audit_log.action_data.memory_id,
 78    openai_chatgpt_enterprise.audit_log.action_data.auth_user_id,
 79    openai_chatgpt_enterprise.audit_log.action_privilege, data_stream.*
 80'''
 81
 82
 83[[rule.threat]]
 84framework = "MITRE ATT&CK"
 85[[rule.threat.technique]]
 86id = "T1070"
 87name = "Indicator Removal"
 88reference = "https://attack.mitre.org/techniques/T1070/"
 89
 90
 91[rule.threat.tactic]
 92id = "TA0005"
 93name = "Defense Evasion"
 94reference = "https://attack.mitre.org/tactics/TA0005/"
 95
 96[[rule.threat_mappings]]
 97framework = "MITRE ATLAS"
 98version = "2026.08"
 99[[rule.threat_mappings.threat]]
100framework = "MITRE ATLAS"
101[[rule.threat_mappings.threat.technique]]
102id = "AML.T0092"
103name = "Manipulate User LLM Chat History"
104reference = "https://atlas.mitre.org/techniques/AML.T0092/"
105
106
107[rule.threat_mappings.threat.tactic]
108id = "AML.TA0007"
109name = "Defense Evasion"
110reference = "https://atlas.mitre.org/tactics/AML.TA0007/"
111
112[rule.investigation_fields]
113field_names = [
114    "@timestamp",
115    "event.action",
116    "user.id",
117    "openai_chatgpt_enterprise.audit_log.action_data.memory_id",
118    "source.ip",
119]