OpenAI ChatGPT Enterprise Repeated Assistant Refusals

  1[metadata]
  2creation_date = "2026/10/08"
  3integration = ["openai_chatgpt_enterprise"]
  4maturity = "production"
  5updated_date = "2026/10/09"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects three or more ChatGPT Enterprise assistant messages for the same user whose text matches common policy-refusal
 11phrases (cannot assist, cannot help, cannot fulfill, unable to assist, against my guidelines, and similar) within the
 12lookback window. A refusal burst can indicate jailbreak probing, policy-bypass attempts, or automated unsafe prompting
 13intended to evade model safety controls.
 14"""
 15false_positives = [
 16    """
 17    Approved red-team or prompt-security evaluations that intentionally elicit refusals. Exclude those users or raise
 18    the count threshold.
 19    """,
 20    """
 21    Long helpful answers that incidentally include phrases such as "I can't help with X, but I can help with Y." Read
 22    the sampled messages before treating the alert as a hard refusal campaign.
 23    """,
 24]
 25from = "now-60m"
 26interval = "10m"
 27language = "esql"
 28license = "Elastic License v2"
 29name = "OpenAI ChatGPT Enterprise Repeated Assistant Refusals"
 30note = """## Triage and analysis
 31
 32### Investigating OpenAI ChatGPT Enterprise Repeated Assistant Refusals
 33
 34One user received three or more assistant replies whose text matches common refusal phrasing in the lookback window.
 35That pattern can indicate jailbreak probing, attempts to elicit disallowed content, or scripted unsafe prompting.
 36
 37Escalate when the sampled messages are clear hard refusals, nearby prompts look adversarial, or the same user also
 38triggers credential-exposure or unusual Codex MCP activity. Close as a false positive for approved security evaluations
 39or partial phrases inside otherwise helpful answers.
 40
 41#### Possible investigation steps
 42
 43- Review `Esql.message_values`, `Esql.event_count`, and `Esql.conversation_id_count_distinct` on the alert.
 44- Pull surrounding user messages in the same conversation IDs for jailbreak or malware-request themes.
 45- Correlate with credential-in-conversation, Codex MCP, share, and download activity from the same `user.email`.
 46- Confirm whether the account is used for approved prompt-security testing.
 47
 48### False positive analysis
 49
 50- Approved red-team or model-evaluation traffic that intentionally elicits refusals.
 51- Soft refusals embedded in longer helpful answers (for example, declining malware assistance while offering defensive
 52  guidance).
 53
 54### Response and remediation
 55
 56- If probing is unauthorized, restrict the account, review recent conversations, and hunt for successful bypasses after
 57  the refusal burst.
 58- Use confirmed jailbreak prompts to improve prompt-security controls and user awareness where appropriate.
 59"""
 60references = [
 61    "https://www.elastic.co/docs/reference/integrations/openai_chatgpt_enterprise",
 62    "https://platform.openai.com/docs/compliance",
 63]
 64risk_score = 73
 65rule_id = "1a2bb7a5-6172-4649-bb1e-bcd423cace52"
 66setup = """## Setup
 67
 68This rule requires the OpenAI ChatGPT Enterprise integration to collect conversation message compliance logs into
 69Elasticsearch.
 70
 71https://www.elastic.co/docs/reference/integrations/openai_chatgpt_enterprise
 72"""
 73severity = "high"
 74tags = [
 75    "Domain: GenAI",
 76    "Platform: OpenAI",
 77    "Data Source: OpenAI ChatGPT Enterprise",
 78    "Service: OpenAI ChatGPT Enterprise",
 79    "Use Case: Policy Violation",
 80    "Use Case: Threat Detection",
 81    "Resources: Investigation Guide",
 82    "Rule Type: ES|QL",
 83    "Tactic: Defense Evasion",
 84    "Mitre Atlas: AML.T0051",
 85    "Mitre Atlas: AML.T0054",
 86]
 87timestamp_override = "event.ingested"
 88type = "esql"
 89
 90query = '''
 91from logs-openai_chatgpt_enterprise.conversation_message-*
 92| where
 93    data_stream.dataset == "openai_chatgpt_enterprise.conversation_message" and
 94    openai_chatgpt_enterprise.conversation_message.message.author.type == "assistant" and
 95    message is not null and
 96    user.email is not null
 97| eval Esql.message_text = to_lower(message)
 98| where
 99    Esql.message_text like "*i can't assist*" or
100    Esql.message_text like "*i can't help*" or
101    Esql.message_text like "*i cannot fulfill*" or
102    Esql.message_text like "*i cannot help*" or
103    Esql.message_text like "*i cannot provide*" or
104    Esql.message_text like "*i can't provide*" or
105    Esql.message_text like "*i will not provide*" or
106    Esql.message_text like "*i won't provide*" or
107    Esql.message_text like "*i cannot answer*" or
108    Esql.message_text like "*i can't answer*" or
109    Esql.message_text like "*unable to assist*" or
110    Esql.message_text like "*against my guidelines*"
111| stats
112    Esql.event_count = count(*),
113    Esql.conversation_id_count_distinct = count_distinct(openai_chatgpt_enterprise.conversation_message.conversation.id),
114    Esql.message_values = values(message),
115    Esql.timestamp_first_seen = min(@timestamp),
116    Esql.timestamp_last_seen = max(@timestamp)
117  by
118    user.email,
119    organization.id
120| where Esql.event_count >= 3
121| keep
122    user.email,
123    organization.id,
124    Esql.event_count,
125    Esql.conversation_id_count_distinct,
126    Esql.message_values,
127    Esql.timestamp_first_seen,
128    Esql.timestamp_last_seen
129'''
130
131
132[[rule.threat]]
133framework = "MITRE ATT&CK"
134[[rule.threat.technique]]
135id = "T1562"
136name = "Impair Defenses"
137reference = "https://attack.mitre.org/techniques/T1562/"
138
139
140[rule.threat.tactic]
141id = "TA0005"
142name = "Defense Evasion"
143reference = "https://attack.mitre.org/tactics/TA0005/"
144[[rule.threat_mappings]]
145framework = "MITRE ATLAS"
146version = "2026.08"
147[[rule.threat_mappings.threat]]
148framework = "MITRE ATLAS"
149[[rule.threat_mappings.threat.technique]]
150id = "AML.T0051"
151name = "LLM Prompt Injection"
152reference = "https://atlas.mitre.org/techniques/AML.T0051/"
153
154
155[rule.threat_mappings.threat.tactic]
156id = "AML.TA0005"
157name = "Execution"
158reference = "https://atlas.mitre.org/tactics/AML.TA0005/"
159[[rule.threat_mappings.threat]]
160framework = "MITRE ATLAS"
161[[rule.threat_mappings.threat.technique]]
162id = "AML.T0054"
163name = "LLM Jailbreak"
164reference = "https://atlas.mitre.org/techniques/AML.T0054/"
165
166
167[rule.threat_mappings.threat.tactic]
168id = "AML.TA0007"
169name = "Defense Evasion"
170reference = "https://atlas.mitre.org/tactics/AML.TA0007/"
171
172[rule.alert_suppression]
173group_by = ["user.email", "organization.id"]
174missing_fields_strategy = "suppress"
175
176[rule.investigation_fields]
177field_names = [
178    "user.email",
179    "organization.id",
180    "Esql.event_count",
181    "Esql.conversation_id_count_distinct",
182    "Esql.message_values",
183    "Esql.timestamp_first_seen",
184    "Esql.timestamp_last_seen",
185]
186
187[rule.alert_suppression.duration]
188unit = "h"
189value = 1