OpenAI ChatGPT Enterprise Codex Access Token Created

  1[metadata]
  2creation_date = "2026/10/06"
  3integration = ["openai_chatgpt_enterprise"]
  4maturity = "production"
  5updated_date = "2026/10/06"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects ChatGPT Enterprise Codex events that create an access token. Codex access tokens enable automated CLI or
 11environment access and can be abused for persistence or lateral automation after account compromise. Treat tokens with
 12a missing `expires_at` as higher priority during triage.
 13"""
 14false_positives = [
 15    "Developers create Codex tokens for CI runners and local environments.",
 16]
 17from = "now-9m"
 18language = "esql"
 19license = "Elastic License v2"
 20name = "OpenAI ChatGPT Enterprise Codex Access Token Created"
 21note = """## Triage and analysis
 22
 23### Investigating OpenAI ChatGPT Enterprise Codex Access Token Created
 24
 25A Codex access token was created. These tokens enable automated CLI or environment access and can be abused for persistence or automation after account compromise.
 26
 27Escalate when the token owner or purpose is unclear, the creator is unexpected, or tool and MCP activity follows immediately. Close as a false positive for documented CI or local development token creation.
 28
 29#### Possible investigation steps
 30
 31- Identify the creator (`user.email` / `user.id`) and token-related fields on the alert.
 32- Confirm the intended automation use and whether a ticket or runbook covers the token.
 33- Review subsequent Codex tool calls, MCP activity, or security-scan changes from the same user or client.
 34- Inventory other active Codex tokens for the same user.
 35
 36### False positive analysis
 37
 38- Developers create Codex tokens for CI runners and local development environments as part of normal workflows.
 39
 40### Response and remediation
 41
 42- Revoke unauthorized tokens and review subsequent Codex tool and MCP activity.
 43- Rotate related credentials if the token may have been exposed.
 44"""
 45references = [
 46    "https://www.elastic.co/docs/reference/integrations/openai_chatgpt_enterprise",
 47    "https://platform.openai.com/docs/compliance",
 48]
 49risk_score = 47
 50rule_id = "0280b13a-65a8-4475-8f43-c8304b7e3467"
 51setup = """## Setup
 52
 53This rule requires the OpenAI ChatGPT Enterprise integration to collect compliance logs into Elasticsearch.
 54
 55https://www.elastic.co/docs/reference/integrations/openai_chatgpt_enterprise
 56"""
 57severity = "medium"
 58tags = [
 59    "Domain: GenAI",
 60    "Platform: OpenAI",
 61    "Data Source: OpenAI ChatGPT Enterprise",
 62    "Service: OpenAI ChatGPT Enterprise",
 63    "Use Case: Threat Detection",
 64    "Resources: Investigation Guide",
 65    "Rule Type: ES|QL",
 66    "Tactic: Persistence",
 67    "Mitre Atlas: AML.T0083",
 68]
 69timestamp_override = "event.ingested"
 70type = "esql"
 71
 72query = '''
 73from logs-openai_chatgpt_enterprise.codex_log-* metadata _id, _version, _index
 74| where
 75    data_stream.dataset == "openai_chatgpt_enterprise.codex_log" and
 76    event.action == "access_token_created"
 77| keep
 78    _id, _version, _index, @timestamp, event.action, user.id, user.email,
 79    openai_chatgpt_enterprise.codex_log.client_id,
 80    openai_chatgpt_enterprise.codex_log.event_details.access_token_id,
 81    openai_chatgpt_enterprise.codex_log.event_details.access_token_name,
 82    openai_chatgpt_enterprise.codex_log.event_details.created_by_user_id,
 83    openai_chatgpt_enterprise.codex_log.event_details.expires_at,
 84    data_stream.*
 85'''
 86
 87
 88[[rule.threat]]
 89framework = "MITRE ATT&CK"
 90[[rule.threat.technique]]
 91id = "T1098"
 92name = "Account Manipulation"
 93reference = "https://attack.mitre.org/techniques/T1098/"
 94
 95
 96[rule.threat.tactic]
 97id = "TA0003"
 98name = "Persistence"
 99reference = "https://attack.mitre.org/tactics/TA0003/"
100
101[[rule.threat_mappings]]
102framework = "MITRE ATLAS"
103version = "2026.08"
104[[rule.threat_mappings.threat]]
105framework = "MITRE ATLAS"
106[[rule.threat_mappings.threat.technique]]
107id = "AML.T0083"
108name = "Credentials from AI Agent Configuration"
109reference = "https://atlas.mitre.org/techniques/AML.T0083/"
110
111
112[rule.threat_mappings.threat.tactic]
113id = "AML.TA0013"
114name = "Credential Access"
115reference = "https://atlas.mitre.org/tactics/AML.TA0013/"
116
117[rule.investigation_fields]
118field_names = [
119    "@timestamp",
120    "user.id",
121    "user.email",
122    "openai_chatgpt_enterprise.codex_log.event_details.access_token_name",
123    "openai_chatgpt_enterprise.codex_log.event_details.access_token_id",
124    "openai_chatgpt_enterprise.codex_log.client_id",
125]