OpenAI ChatGPT Enterprise App Authentication Linked

  1[metadata]
  2creation_date = "2026/10/06"
  3integration = ["openai_chatgpt_enterprise"]
  4maturity = "production"
  5updated_date = "2026/10/06"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects ChatGPT Enterprise app authentication events that link a third-party app to a user or workspace. Linking apps
 11establishes durable OAuth-style access that adversaries can use to persist connectors after initial compromise.
 12"""
 13false_positives = [
 14    "Users legitimately connect approved apps during onboarding.",
 15    "Common Google Drive/Gmail and Slack connector app_id values are excluded; other sanctioned connectors may still alert.",
 16]
 17from = "now-9m"
 18language = "esql"
 19license = "Elastic License v2"
 20name = "OpenAI ChatGPT Enterprise App Authentication Linked"
 21note = """## Triage and analysis
 22
 23### Investigating OpenAI ChatGPT Enterprise App Authentication Linked
 24
 25A third-party app was linked to a user or workspace. Linking establishes durable OAuth-style access that can persist after the initial session ends.
 26
 27Escalate when the app is unapproved, the actor recently had suspicious authentication activity, or multiple unusual apps are linked in a short window. Close as a false positive for expected onboarding of approved apps.
 28
 29#### Possible investigation steps
 30
 31- Identify the user and the linked app details on the alert.
 32- Confirm the app is in the approved workspace inventory.
 33- Correlate with suspicious user agents, impossible travel, or privileged audit activity nearby.
 34- Review whether the linked app can access sensitive data or connectors.
 35
 36### False positive analysis
 37
 38- Users legitimately connect approved apps during onboarding or project setup.
 39
 40### Response and remediation
 41
 42- Unlink unauthorized apps and rotate related OAuth credentials.
 43- Review other persistence-oriented changes by the same actor.
 44"""
 45references = [
 46    "https://www.elastic.co/docs/reference/integrations/openai_chatgpt_enterprise",
 47    "https://platform.openai.com/docs/compliance",
 48]
 49risk_score = 47
 50rule_id = "f453f820-61cf-4618-a2eb-7af304b36747"
 51setup = """## Setup
 52
 53This rule requires the OpenAI ChatGPT Enterprise integration to collect compliance logs into Elasticsearch.
 54
 55https://www.elastic.co/docs/reference/integrations/openai_chatgpt_enterprise
 56"""
 57severity = "medium"
 58tags = [
 59    "Domain: GenAI",
 60    "Platform: OpenAI",
 61    "Data Source: OpenAI ChatGPT Enterprise",
 62    "Service: OpenAI ChatGPT Enterprise",
 63    "Use Case: Threat Detection",
 64    "Resources: Investigation Guide",
 65    "Rule Type: ES|QL",
 66    "Tactic: Persistence",
 67    "Mitre Atlas: AML.T0081",
 68]
 69timestamp_override = "event.ingested"
 70type = "esql"
 71
 72query = '''
 73from logs-openai_chatgpt_enterprise.app_auth_log-* metadata _id, _version, _index
 74| where
 75    data_stream.dataset == "openai_chatgpt_enterprise.app_auth_log" and
 76    event.action == "link" and
 77    not openai_chatgpt_enterprise.app_auth_log.app_id in (
 78        "connector_5f3c8c41a1e54ad7a76272c89e2554fa",
 79        "connector_2128aebfecb84f64a069897515042a44",
 80        "connector_947e0d954944416db111db556030eea6",
 81        "asdk_app_69a1d78e929881919bba0dbda1f6436d"
 82    )
 83| keep
 84    _id, _version, _index, @timestamp, event.action, user.id, user.email,
 85    openai_chatgpt_enterprise.app_auth_log.app_id,
 86    openai_chatgpt_enterprise.app_auth_log.link_id,
 87    openai_chatgpt_enterprise.app_auth_log.actor.type,
 88    openai_chatgpt_enterprise.app_auth_log.principal.type,
 89    data_stream.*
 90'''
 91
 92
 93[[rule.threat]]
 94framework = "MITRE ATT&CK"
 95[[rule.threat.technique]]
 96id = "T1098"
 97name = "Account Manipulation"
 98reference = "https://attack.mitre.org/techniques/T1098/"
 99
100
101[rule.threat.tactic]
102id = "TA0003"
103name = "Persistence"
104reference = "https://attack.mitre.org/tactics/TA0003/"
105
106[[rule.threat_mappings]]
107framework = "MITRE ATLAS"
108version = "2026.08"
109[[rule.threat_mappings.threat]]
110framework = "MITRE ATLAS"
111[[rule.threat_mappings.threat.technique]]
112id = "AML.T0081"
113name = "Modify AI Agent Configuration"
114reference = "https://atlas.mitre.org/techniques/AML.T0081/"
115
116
117[rule.threat_mappings.threat.tactic]
118id = "AML.TA0006"
119name = "Persistence"
120reference = "https://atlas.mitre.org/tactics/AML.TA0006/"
121
122[rule.investigation_fields]
123field_names = [
124    "@timestamp",
125    "event.action",
126    "user.id",
127    "user.email",
128    "openai_chatgpt_enterprise.app_auth_log.app_id",
129    "openai_chatgpt_enterprise.app_auth_log.link_id",
130]