OpenAI ChatGPT Enterprise Custom Agent Trigger Changed

  1[metadata]
  2creation_date = "2026/10/06"
  3integration = ["openai_chatgpt_enterprise"]
  4maturity = "production"
  5updated_date = "2026/10/06"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects ChatGPT Enterprise custom-agent events that create or update a trigger. Triggers can schedule or event-drive
 11agent runs without interactive user presence, enabling persistence and automation abuse.
 12"""
 13false_positives = [
 14    "Operations teams create approved triggers for recurring agent workflows.",
 15]
 16from = "now-9m"
 17language = "esql"
 18license = "Elastic License v2"
 19name = "OpenAI ChatGPT Enterprise Custom Agent Trigger Changed"
 20note = """## Triage and analysis
 21
 22### Investigating OpenAI ChatGPT Enterprise Custom Agent Trigger Changed
 23
 24An agent trigger was created or updated. Triggers can schedule or event-drive agent runs without interactive user presence.
 25
 26Escalate when the schedule or event scope is overly broad, required actions are sensitive, or the actor is unauthorized. Close as a false positive for approved recurring operational workflows.
 27
 28#### Possible investigation steps
 29
 30- Identify the actor, agent, and trigger configuration on the alert.
 31- Confirm schedule or event scope and the actions the trigger can invoke.
 32- Review recent agent runs associated with the trigger or agent.
 33- Correlate with agent publish or connector-link events from the same actor.
 34
 35### False positive analysis
 36
 37- Operations teams create approved triggers for recurring agent workflows.
 38
 39### Response and remediation
 40
 41- Delete unauthorized triggers and review recent agent runs for unexpected automation.
 42"""
 43references = [
 44    "https://www.elastic.co/docs/reference/integrations/openai_chatgpt_enterprise",
 45    "https://platform.openai.com/docs/compliance",
 46]
 47risk_score = 47
 48rule_id = "a801600e-6010-420f-92ba-c83c1904ebf9"
 49setup = """## Setup
 50
 51This rule requires the OpenAI ChatGPT Enterprise integration to collect compliance logs into Elasticsearch.
 52
 53https://www.elastic.co/docs/reference/integrations/openai_chatgpt_enterprise
 54"""
 55severity = "medium"
 56tags = [
 57    "Domain: GenAI",
 58    "Platform: OpenAI",
 59    "Data Source: OpenAI ChatGPT Enterprise",
 60    "Service: OpenAI ChatGPT Enterprise",
 61    "Use Case: Threat Detection",
 62    "Resources: Investigation Guide",
 63    "Rule Type: ES|QL",
 64    "Tactic: Persistence",
 65    "Mitre Atlas: AML.T0081",
 66]
 67timestamp_override = "event.ingested"
 68type = "esql"
 69
 70query = '''
 71from logs-openai_chatgpt_enterprise.custom_agents_log-* metadata _id, _version, _index
 72| where
 73    data_stream.dataset == "openai_chatgpt_enterprise.custom_agents_log" and
 74    event.action in ("trigger_created", "trigger_updated")
 75| keep
 76    _id, _version, _index, @timestamp, event.action, user.id, user.email,
 77    gen_ai.agent.id,
 78    openai_chatgpt_enterprise.custom_agents_log.client_id,
 79    openai_chatgpt_enterprise.custom_agents_log.event_details.trigger_fields.required_actions,
 80    data_stream.*
 81'''
 82
 83
 84[[rule.threat]]
 85framework = "MITRE ATT&CK"
 86[[rule.threat.technique]]
 87id = "T1053"
 88name = "Scheduled Task/Job"
 89reference = "https://attack.mitre.org/techniques/T1053/"
 90
 91
 92[rule.threat.tactic]
 93id = "TA0003"
 94name = "Persistence"
 95reference = "https://attack.mitre.org/tactics/TA0003/"
 96
 97[[rule.threat_mappings]]
 98framework = "MITRE ATLAS"
 99version = "2026.08"
100[[rule.threat_mappings.threat]]
101framework = "MITRE ATLAS"
102[[rule.threat_mappings.threat.technique]]
103id = "AML.T0081"
104name = "Modify AI Agent Configuration"
105reference = "https://atlas.mitre.org/techniques/AML.T0081/"
106
107
108[rule.threat_mappings.threat.tactic]
109id = "AML.TA0006"
110name = "Persistence"
111reference = "https://atlas.mitre.org/tactics/AML.TA0006/"
112
113[rule.investigation_fields]
114field_names = [
115    "@timestamp",
116    "event.action",
117    "user.id",
118    "gen_ai.agent.id",
119    "openai_chatgpt_enterprise.custom_agents_log.event_details.trigger_fields.required_actions",
120]