OpenAI ChatGPT Enterprise Conversation Shared

  1[metadata]
  2creation_date = "2026/10/06"
  3integration = ["openai_chatgpt_enterprise"]
  4maturity = "production"
  5updated_date = "2026/10/06"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects ChatGPT Enterprise audit events where a conversation is shared. Sharing can expose prompts, completions, and
 11attached files outside the original conversation participants and may be used to exfiltrate sensitive content.
 12"""
 13false_positives = [
 14    "Users intentionally share conversations for collaboration within the organization.",
 15]
 16from = "now-9m"
 17language = "esql"
 18license = "Elastic License v2"
 19name = "OpenAI ChatGPT Enterprise Conversation Shared"
 20note = """## Triage and analysis
 21
 22### Investigating OpenAI ChatGPT Enterprise Conversation Shared
 23
 24A conversation was shared. Sharing can expose prompts, responses, and attached context beyond the original participants.
 25
 26Escalate when the audience is external or overly broad, the conversation contains sensitive data, or sharing coincides with downloads or mass deletion. Close as a false positive for expected collaboration inside the organization.
 27
 28#### Possible investigation steps
 29
 30- Identify the user, conversation, and share-related fields on the alert.
 31- Determine the intended audience and whether it matches workspace sharing policy.
 32- Review nearby message content, file downloads, or additional shares from the same user.
 33- Check whether the conversation includes credentials, proprietary code, or customer data.
 34
 35### False positive analysis
 36
 37- Users intentionally share conversations for collaboration within the organization when that sharing path is approved.
 38
 39### Response and remediation
 40
 41- Revoke unauthorized shares and review other sharing activity by the same actor.
 42- If sensitive content was exposed, follow your data-incident process for the recipients and channel used.
 43"""
 44references = [
 45    "https://www.elastic.co/docs/reference/integrations/openai_chatgpt_enterprise",
 46    "https://platform.openai.com/docs/compliance",
 47]
 48risk_score = 47
 49rule_id = "9246f273-b33f-465b-8966-c27e151ded78"
 50setup = """## Setup
 51
 52This rule requires the OpenAI ChatGPT Enterprise integration to collect compliance logs into Elasticsearch.
 53
 54https://www.elastic.co/docs/reference/integrations/openai_chatgpt_enterprise
 55"""
 56severity = "medium"
 57tags = [
 58    "Domain: GenAI",
 59    "Platform: OpenAI",
 60    "Data Source: OpenAI ChatGPT Enterprise",
 61    "Service: OpenAI ChatGPT Enterprise",
 62    "Use Case: Threat Detection",
 63    "Resources: Investigation Guide",
 64    "Rule Type: ES|QL",
 65    "Tactic: Exfiltration",
 66    "Mitre Atlas: AML.T0025",
 67]
 68timestamp_override = "event.ingested"
 69type = "esql"
 70
 71query = '''
 72from logs-openai_chatgpt_enterprise.audit_log-* metadata _id, _version, _index
 73| where
 74    data_stream.dataset == "openai_chatgpt_enterprise.audit_log" and
 75    event.action == "conversation_share"
 76| keep
 77    _id, _version, _index, @timestamp, event.action, user.id, user.email, source.ip,
 78    openai_chatgpt_enterprise.audit_log.action_data.conversation_id,
 79    openai_chatgpt_enterprise.audit_log.action_data.shared_conversation_id,
 80    openai_chatgpt_enterprise.audit_log.action_data.already_exists,
 81    openai_chatgpt_enterprise.audit_log.action_privilege, data_stream.*
 82'''
 83
 84
 85[[rule.threat]]
 86framework = "MITRE ATT&CK"
 87[[rule.threat.technique]]
 88id = "T1567"
 89name = "Exfiltration Over Web Service"
 90reference = "https://attack.mitre.org/techniques/T1567/"
 91
 92
 93[rule.threat.tactic]
 94id = "TA0010"
 95name = "Exfiltration"
 96reference = "https://attack.mitre.org/tactics/TA0010/"
 97
 98[[rule.threat_mappings]]
 99framework = "MITRE ATLAS"
100version = "2026.08"
101[[rule.threat_mappings.threat]]
102framework = "MITRE ATLAS"
103[[rule.threat_mappings.threat.technique]]
104id = "AML.T0025"
105name = "Exfiltration via Cyber Means"
106reference = "https://atlas.mitre.org/techniques/AML.T0025/"
107
108
109[rule.threat_mappings.threat.tactic]
110id = "AML.TA0010"
111name = "Exfiltration"
112reference = "https://atlas.mitre.org/tactics/AML.TA0010/"
113
114[rule.investigation_fields]
115field_names = [
116    "@timestamp",
117    "event.action",
118    "user.id",
119    "openai_chatgpt_enterprise.audit_log.action_data.conversation_id",
120    "openai_chatgpt_enterprise.audit_log.action_data.shared_conversation_id",
121    "source.ip",
122]