OpenAI ChatGPT Enterprise Custom Agent Published

  1[metadata]
  2creation_date = "2026/10/06"
  3integration = ["openai_chatgpt_enterprise"]
  4maturity = "production"
  5updated_date = "2026/10/06"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects ChatGPT Enterprise custom-agent publish events (`agent_published`). Publishing an agent with connectors,
 11skills, or store visibility can establish durable automation and broaden data access beyond the original user.
 12"""
 13false_positives = [
 14    "Platform teams publish approved custom agents during workspace rollouts.",
 15]
 16from = "now-9m"
 17language = "esql"
 18license = "Elastic License v2"
 19name = "OpenAI ChatGPT Enterprise Custom Agent Published"
 20note = """## Triage and analysis
 21
 22### Investigating OpenAI ChatGPT Enterprise Custom Agent Published
 23
 24A custom agent was published. Published agents with connectors, skills, and store visibility can establish durable automation and broaden data access.
 25
 26Escalate when visibility is broader than expected, connectors are sensitive, or the publisher is not authorized to release agents. Close as a false positive for approved platform rollouts.
 27
 28#### Possible investigation steps
 29
 30- Identify the actor and agent identifiers on the alert.
 31- Review connectors, skills, store visibility, and any release notes or description fields.
 32- Confirm whether publication matches an approved change request.
 33- Look for related trigger creation or OAuth link events from the same actor.
 34
 35### False positive analysis
 36
 37- Platform teams publish approved custom agents during controlled workspace rollouts.
 38
 39### Response and remediation
 40
 41- Unpublish or delete unauthorized agents and revoke connected OAuth links.
 42- Review recent agent runs if the agent may already have executed.
 43"""
 44references = [
 45    "https://www.elastic.co/docs/reference/integrations/openai_chatgpt_enterprise",
 46    "https://platform.openai.com/docs/compliance",
 47]
 48risk_score = 47
 49rule_id = "c73d406c-4399-40f2-a255-4a42f8ead9e0"
 50setup = """## Setup
 51
 52This rule requires the OpenAI ChatGPT Enterprise integration to collect compliance logs into Elasticsearch.
 53
 54https://www.elastic.co/docs/reference/integrations/openai_chatgpt_enterprise
 55"""
 56severity = "medium"
 57tags = [
 58    "Domain: GenAI",
 59    "Platform: OpenAI",
 60    "Data Source: OpenAI ChatGPT Enterprise",
 61    "Service: OpenAI ChatGPT Enterprise",
 62    "Use Case: Threat Detection",
 63    "Resources: Investigation Guide",
 64    "Rule Type: ES|QL",
 65    "Tactic: Persistence",
 66    "Mitre Atlas: AML.T0081",
 67]
 68timestamp_override = "event.ingested"
 69type = "esql"
 70
 71query = '''
 72from logs-openai_chatgpt_enterprise.custom_agents_log-* metadata _id, _version, _index
 73| where
 74    data_stream.dataset == "openai_chatgpt_enterprise.custom_agents_log" and
 75    event.action == "agent_published"
 76| keep
 77    _id, _version, _index, @timestamp, event.action, user.id, user.email,
 78    gen_ai.agent.id,
 79    openai_chatgpt_enterprise.custom_agents_log.client_id,
 80    openai_chatgpt_enterprise.custom_agents_log.event_details.publish_type,
 81    openai_chatgpt_enterprise.custom_agents_log.event_details.release_name,
 82    openai_chatgpt_enterprise.custom_agents_log.event_details.agent_fields.store_visible,
 83    openai_chatgpt_enterprise.custom_agents_log.event_details.agent_fields.workspace_capability,
 84    data_stream.*
 85'''
 86
 87
 88[[rule.threat]]
 89framework = "MITRE ATT&CK"
 90[[rule.threat.technique]]
 91id = "T1176"
 92name = "Software Extensions"
 93reference = "https://attack.mitre.org/techniques/T1176/"
 94
 95
 96[rule.threat.tactic]
 97id = "TA0003"
 98name = "Persistence"
 99reference = "https://attack.mitre.org/tactics/TA0003/"
100
101[[rule.threat_mappings]]
102framework = "MITRE ATLAS"
103version = "2026.08"
104[[rule.threat_mappings.threat]]
105framework = "MITRE ATLAS"
106[[rule.threat_mappings.threat.technique]]
107id = "AML.T0081"
108name = "Modify AI Agent Configuration"
109reference = "https://atlas.mitre.org/techniques/AML.T0081/"
110
111
112[rule.threat_mappings.threat.tactic]
113id = "AML.TA0006"
114name = "Persistence"
115reference = "https://atlas.mitre.org/tactics/AML.TA0006/"
116
117[rule.investigation_fields]
118field_names = [
119    "@timestamp",
120    "event.action",
121    "user.id",
122    "gen_ai.agent.id",
123    "openai_chatgpt_enterprise.custom_agents_log.event_details.agent_fields.store_visible",
124    "openai_chatgpt_enterprise.custom_agents_log.event_details.publish_type",
125]