OpenAI ChatGPT Enterprise Domain Created

  1[metadata]
  2creation_date = "2026/10/06"
  3integration = ["openai_chatgpt_enterprise"]
  4maturity = "production"
  5updated_date = "2026/10/06"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects ChatGPT Enterprise audit events that create a workspace domain boundary entry. Domain changes can expand who
 11is allowed to join or access the tenant and may establish persistence for attacker-controlled domains.
 12"""
 13false_positives = [
 14    "Administrators add legitimate corporate domains during onboarding or M&A.",
 15]
 16from = "now-9m"
 17language = "esql"
 18license = "Elastic License v2"
 19name = "OpenAI ChatGPT Enterprise Domain Created"
 20note = """## Triage and analysis
 21
 22### Investigating OpenAI ChatGPT Enterprise Domain Created
 23
 24A domain was added to the workspace boundary. Domain changes can expand who is allowed to join or access the tenant.
 25
 26Escalate when the domain is not corporate-owned, the change lacks approval, or invites from that domain follow quickly. Close as a false positive for documented onboarding or merger-related domain additions.
 27
 28#### Possible investigation steps
 29
 30- Identify the actor and the domain value on the alert.
 31- Validate ownership of the domain and whether a change request exists.
 32- Search for subsequent invites, role changes, or ownership transfers involving that domain.
 33- Review other IAM changes by the same actor in the surrounding window.
 34
 35### False positive analysis
 36
 37- Administrators add legitimate corporate domains during onboarding or merger activity when the request is approved.
 38
 39### Response and remediation
 40
 41- Remove unauthorized domains and audit subsequent invites associated with that domain.
 42- Rotate credentials for the actor if the change appears malicious.
 43"""
 44references = [
 45    "https://www.elastic.co/docs/reference/integrations/openai_chatgpt_enterprise",
 46    "https://platform.openai.com/docs/compliance",
 47]
 48risk_score = 73
 49rule_id = "282c56ce-6124-4558-a5f0-d5c6c3cc3c2c"
 50setup = """## Setup
 51
 52This rule requires the OpenAI ChatGPT Enterprise integration to collect compliance logs into Elasticsearch.
 53
 54https://www.elastic.co/docs/reference/integrations/openai_chatgpt_enterprise
 55"""
 56severity = "high"
 57tags = [
 58    "Domain: GenAI",
 59    "Platform: OpenAI",
 60    "Data Source: OpenAI ChatGPT Enterprise",
 61    "Service: OpenAI ChatGPT Enterprise",
 62    "Use Case: Threat Detection",
 63    "Resources: Investigation Guide",
 64    "Rule Type: ES|QL",
 65    "Domain: Identity",
 66    "Use Case: Identity and Access Audit",
 67    "Tactic: Persistence",
 68    "Mitre Atlas: AML.T0125",
 69]
 70timestamp_override = "event.ingested"
 71type = "esql"
 72
 73query = '''
 74from logs-openai_chatgpt_enterprise.audit_log-* metadata _id, _version, _index
 75| where
 76    data_stream.dataset == "openai_chatgpt_enterprise.audit_log" and
 77    event.action == "domain_create"
 78| keep
 79    _id, _version, _index, @timestamp, event.action, user.id, user.email, source.ip,
 80    openai_chatgpt_enterprise.audit_log.action_data.hostname,
 81    openai_chatgpt_enterprise.audit_log.action_data.domains,
 82    openai_chatgpt_enterprise.audit_log.action_data.domain_id,
 83    openai_chatgpt_enterprise.audit_log.action_privilege, data_stream.*
 84'''
 85
 86
 87[[rule.threat]]
 88framework = "MITRE ATT&CK"
 89[[rule.threat.technique]]
 90id = "T1098"
 91name = "Account Manipulation"
 92reference = "https://attack.mitre.org/techniques/T1098/"
 93
 94
 95[rule.threat.tactic]
 96id = "TA0003"
 97name = "Persistence"
 98reference = "https://attack.mitre.org/tactics/TA0003/"
 99
100[[rule.threat_mappings]]
101framework = "MITRE ATLAS"
102version = "2026.08"
103[[rule.threat_mappings.threat]]
104framework = "MITRE ATLAS"
105[[rule.threat_mappings.threat.technique]]
106id = "AML.T0125"
107name = "Create Account"
108reference = "https://atlas.mitre.org/techniques/AML.T0125/"
109
110
111[rule.threat_mappings.threat.tactic]
112id = "AML.TA0006"
113name = "Persistence"
114reference = "https://atlas.mitre.org/tactics/AML.TA0006/"
115
116[rule.investigation_fields]
117field_names = [
118    "@timestamp",
119    "event.action",
120    "user.id",
121    "openai_chatgpt_enterprise.audit_log.action_data.hostname",
122    "openai_chatgpt_enterprise.audit_log.action_data.domains",
123    "source.ip",
124]