OpenAI ChatGPT Enterprise User Invite Sent

  1[metadata]
  2creation_date = "2026/10/06"
  3integration = ["openai_chatgpt_enterprise"]
  4maturity = "production"
  5updated_date = "2026/10/09"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects ChatGPT Enterprise audit events that invite a new user into the workspace. An adversary who compromises an
 11administrator can invite a mailbox they control to gain durable access.
 12"""
 13false_positives = ["IT and hiring workflows routinely invite new members during onboarding."]
 14from = "now-9m"
 15language = "esql"
 16license = "Elastic License v2"
 17name = "OpenAI ChatGPT Enterprise User Invite Sent"
 18note = """## Triage and analysis
 19
 20### Investigating OpenAI ChatGPT Enterprise User Invite Sent
 21
 22A workspace invite was sent. An adversary who compromises an administrator can invite a mailbox they control to gain durable access.
 23
 24Escalate when the invitee domain is unexpected, the invited role is privileged, or the actor is unusual. Close as a false positive for routine onboarding with an approved request.
 25
 26#### Possible investigation steps
 27
 28- Inspect invitee email fields, invited role, and actor privilege on the alert.
 29- Compare the invitee domain with trusted corporate domains.
 30- Look for role promotions, owner changes, or domain additions near the invite.
 31- Determine whether the invite was accepted and what activity followed.
 32
 33### False positive analysis
 34
 35- IT and hiring workflows routinely invite new members during onboarding when the invitee and role are expected.
 36
 37### Response and remediation
 38
 39- Revoke unauthorized pending invites, remove the user if already accepted, and rotate compromised admin credentials.
 40"""
 41references = [
 42    "https://www.elastic.co/docs/reference/integrations/openai_chatgpt_enterprise",
 43    "https://platform.openai.com/docs/compliance",
 44]
 45risk_score = 47
 46rule_id = "d0aaa2e8-9bde-4f3b-8599-c767958d45e3"
 47setup = """## Setup
 48
 49This rule requires the OpenAI ChatGPT Enterprise integration to collect compliance logs into Elasticsearch.
 50
 51https://www.elastic.co/docs/reference/integrations/openai_chatgpt_enterprise
 52"""
 53severity = "medium"
 54tags = [
 55    "Domain: GenAI",
 56    "Platform: OpenAI",
 57    "Data Source: OpenAI ChatGPT Enterprise",
 58    "Service: OpenAI ChatGPT Enterprise",
 59    "Use Case: Threat Detection",
 60    "Resources: Investigation Guide",
 61    "Rule Type: ES|QL",
 62    "Domain: Identity",
 63    "Use Case: Identity and Access Audit",
 64    "Tactic: Persistence",
 65    "Mitre Atlas: AML.T0125",
 66]
 67timestamp_override = "event.ingested"
 68type = "esql"
 69
 70query = '''
 71from logs-openai_chatgpt_enterprise.audit_log-* metadata _id, _version, _index
 72| where
 73    data_stream.dataset == "openai_chatgpt_enterprise.audit_log" and
 74    event.action == "invite_send" and
 75    event.outcome == "success"
 76| keep
 77    _id, _version, _index, @timestamp, event.action, event.outcome, user.id, user.email, source.ip,
 78    openai_chatgpt_enterprise.audit_log.action_data.email_addresses,
 79    openai_chatgpt_enterprise.audit_log.action_data.email_address,
 80    openai_chatgpt_enterprise.audit_log.action_data.role,
 81    openai_chatgpt_enterprise.audit_log.action_privilege,
 82    openai_chatgpt_enterprise.audit_log.action_result, data_stream.*
 83'''
 84
 85
 86[[rule.threat]]
 87framework = "MITRE ATT&CK"
 88[[rule.threat.technique]]
 89id = "T1136"
 90name = "Create Account"
 91reference = "https://attack.mitre.org/techniques/T1136/"
 92[[rule.threat.technique.subtechnique]]
 93id = "T1136.003"
 94name = "Cloud Account"
 95reference = "https://attack.mitre.org/techniques/T1136/003/"
 96
 97
 98
 99[rule.threat.tactic]
100id = "TA0003"
101name = "Persistence"
102reference = "https://attack.mitre.org/tactics/TA0003/"
103[[rule.threat_mappings]]
104framework = "MITRE ATLAS"
105version = "2026.08"
106[[rule.threat_mappings.threat]]
107framework = "MITRE ATLAS"
108[[rule.threat_mappings.threat.technique]]
109id = "AML.T0125"
110name = "Create Account"
111reference = "https://atlas.mitre.org/techniques/AML.T0125/"
112
113
114[rule.threat_mappings.threat.tactic]
115id = "AML.TA0006"
116name = "Persistence"
117reference = "https://atlas.mitre.org/tactics/AML.TA0006/"
118
119[rule.investigation_fields]
120field_names = [
121    "@timestamp",
122    "event.action",
123    "user.id",
124    "openai_chatgpt_enterprise.audit_log.action_data.email_addresses",
125    "openai_chatgpt_enterprise.audit_log.action_data.role",
126    "openai_chatgpt_enterprise.audit_log.action_privilege",
127    "source.ip",
128]