OpenAI ChatGPT Enterprise Account Owner Role Assigned

  1[metadata]
  2creation_date = "2026/10/06"
  3integration = ["openai_chatgpt_enterprise"]
  4maturity = "production"
  5updated_date = "2026/10/06"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects ChatGPT Enterprise audit events where a user role is updated to account-owner. Account owners control
 11workspace membership, connectors, usage limits, and other security-sensitive settings. An adversary who promotes a
 12compromised account to owner gains durable control-plane access.
 13"""
 14false_positives = [
 15    "IT administrators legitimately promote users to account-owner during staffing changes.",
 16]
 17from = "now-9m"
 18language = "esql"
 19license = "Elastic License v2"
 20name = "OpenAI ChatGPT Enterprise Account Owner Role Assigned"
 21note = """## Triage and analysis
 22
 23### Investigating OpenAI ChatGPT Enterprise Account Owner Role Assigned
 24
 25A user role was updated to `account-owner`. Account owners control workspace membership, connectors, usage limits, and other security-sensitive settings.
 26
 27Escalate when the promotion lacks change management, the actor is unexpected, or privileged activity follows. Close as a false positive for planned ownership transfers with an approved request.
 28
 29#### Possible investigation steps
 30
 31- Identify the actor (`user.id` / `user.email`) and the target user in `openai_chatgpt_enterprise.audit_log.action_data`.
 32- Confirm whether a ticket or change request authorized the promotion.
 33- Review invites, usage-limit changes, plugin or feature policy updates, and log exports after the promotion.
 34- Check authentication anomalies for the actor or target around the same time.
 35
 36### False positive analysis
 37
 38- IT administrators legitimately promote users to account-owner during staffing or ownership changes when the request is approved.
 39
 40### Response and remediation
 41
 42- Downgrade unauthorized owners, revoke sessions, and audit other IAM changes by the same actor.
 43"""
 44references = [
 45    "https://www.elastic.co/docs/reference/integrations/openai_chatgpt_enterprise",
 46    "https://platform.openai.com/docs/compliance",
 47]
 48risk_score = 73
 49rule_id = "109e5d9f-3436-4ea9-8660-1810b5d40237"
 50setup = """## Setup
 51
 52This rule requires the OpenAI ChatGPT Enterprise integration to collect compliance logs into Elasticsearch.
 53
 54https://www.elastic.co/docs/reference/integrations/openai_chatgpt_enterprise
 55"""
 56severity = "high"
 57tags = [
 58    "Domain: GenAI",
 59    "Platform: OpenAI",
 60    "Data Source: OpenAI ChatGPT Enterprise",
 61    "Service: OpenAI ChatGPT Enterprise",
 62    "Use Case: Threat Detection",
 63    "Resources: Investigation Guide",
 64    "Rule Type: ES|QL",
 65    "Domain: Identity",
 66    "Use Case: Identity and Access Audit",
 67    "Tactic: Persistence",
 68    "Tactic: Privilege Escalation",
 69    "Mitre Atlas: AML.T0012",
 70]
 71timestamp_override = "event.ingested"
 72type = "esql"
 73
 74query = '''
 75from logs-openai_chatgpt_enterprise.audit_log-* metadata _id, _version, _index
 76| where
 77    data_stream.dataset == "openai_chatgpt_enterprise.audit_log" and
 78    event.action == "user_role_updated" and
 79    (
 80        openai_chatgpt_enterprise.audit_log.action_data.new_role == "account-owner" or
 81        openai_chatgpt_enterprise.audit_log.action_data.role == "account-owner"
 82    )
 83| keep
 84    _id, _version, _index, @timestamp, event.action, event.outcome, user.id, user.email, source.ip,
 85    source.geo.country_iso_code, openai_chatgpt_enterprise.audit_log.action_data.role,
 86    openai_chatgpt_enterprise.audit_log.action_data.new_role,
 87    openai_chatgpt_enterprise.audit_log.action_data.previous_role,
 88    openai_chatgpt_enterprise.audit_log.action_data.user_id,
 89    openai_chatgpt_enterprise.audit_log.action_privilege,
 90    openai_chatgpt_enterprise.audit_log.actor.type, data_stream.*
 91'''
 92
 93
 94[[rule.threat]]
 95framework = "MITRE ATT&CK"
 96[[rule.threat.technique]]
 97id = "T1098"
 98name = "Account Manipulation"
 99reference = "https://attack.mitre.org/techniques/T1098/"
100[[rule.threat.technique.subtechnique]]
101id = "T1098.003"
102name = "Additional Cloud Roles"
103reference = "https://attack.mitre.org/techniques/T1098/003/"
104
105
106[rule.threat.tactic]
107id = "TA0003"
108name = "Persistence"
109reference = "https://attack.mitre.org/tactics/TA0003/"
110
111[[rule.threat]]
112framework = "MITRE ATT&CK"
113[[rule.threat.technique]]
114id = "T1098"
115name = "Account Manipulation"
116reference = "https://attack.mitre.org/techniques/T1098/"
117[[rule.threat.technique.subtechnique]]
118id = "T1098.003"
119name = "Additional Cloud Roles"
120reference = "https://attack.mitre.org/techniques/T1098/003/"
121
122
123[rule.threat.tactic]
124id = "TA0004"
125name = "Privilege Escalation"
126reference = "https://attack.mitre.org/tactics/TA0004/"
127
128[[rule.threat_mappings]]
129framework = "MITRE ATLAS"
130version = "2026.08"
131[[rule.threat_mappings.threat]]
132framework = "MITRE ATLAS"
133[[rule.threat_mappings.threat.technique]]
134id = "AML.T0012"
135name = "Valid Accounts"
136reference = "https://atlas.mitre.org/techniques/AML.T0012/"
137
138
139[rule.threat_mappings.threat.tactic]
140id = "AML.TA0012"
141name = "Privilege Escalation"
142reference = "https://atlas.mitre.org/tactics/AML.TA0012/"
143
144[rule.investigation_fields]
145field_names = [
146    "@timestamp",
147    "event.action",
148    "user.id",
149    "user.email",
150    "openai_chatgpt_enterprise.audit_log.action_data.role",
151    "openai_chatgpt_enterprise.audit_log.action_data.new_role",
152    "openai_chatgpt_enterprise.audit_log.action_data.previous_role",
153    "openai_chatgpt_enterprise.audit_log.action_data.user_id",
154    "openai_chatgpt_enterprise.audit_log.action_privilege",
155    "source.ip",
156]