OpenAI ChatGPT Enterprise User Invite Sent

edit

IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

OpenAI ChatGPT Enterprise User Invite Sent

edit

Detects ChatGPT Enterprise audit events that invite a new user into the workspace. An adversary who compromises an administrator can invite a mailbox they control to gain durable access.

Rule type: esql

Rule indices: None

Severity: medium

Risk score: 47

Runs every: 5m

Searches indices from: now-9m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

Tags:

Domain: GenAI
Platform: OpenAI
Data Source: OpenAI ChatGPT Enterprise
Service: OpenAI ChatGPT Enterprise
Use Case: Threat Detection
Resources: Investigation Guide
Rule Type: ES|QL
Domain: Identity
Use Case: Identity and Access Audit
Tactic: Persistence
Mitre Atlas: AML.T0125

Version: 1

Rule authors:

Elastic

Rule license: Elastic License v2

Investigation guide

edit

Triage and analysis

Investigating OpenAI ChatGPT Enterprise User Invite Sent

A workspace invite was sent. An adversary who compromises an administrator can invite a mailbox they control to gain durable access.

Escalate when the invitee domain is unexpected, the invited role is privileged, or the actor is unusual. Close as a false positive for routine onboarding with an approved request.

Possible investigation steps

Inspect invitee email fields, invited role, and actor privilege on the alert.
Compare the invitee domain with trusted corporate domains.
Look for role promotions, owner changes, or domain additions near the invite.
Determine whether the invite was accepted and what activity followed.

False positive analysis

IT and hiring workflows routinely invite new members during onboarding when the invitee and role are expected.

Response and remediation

Revoke unauthorized pending invites, remove the user if already accepted, and rotate compromised admin credentials.

Setup

edit

Setup

This rule requires the OpenAI ChatGPT Enterprise integration to collect compliance logs into Elasticsearch.

https://www.elastic.co/docs/reference/integrations/openai_chatgpt_enterprise

Rule query

edit

from logs-openai_chatgpt_enterprise.audit_log-* metadata _id, _version, _index
| where
    data_stream.dataset == "openai_chatgpt_enterprise.audit_log" and
    event.action == "invite_send" and
    event.outcome == "success"
| keep
    _id, _version, _index, @timestamp, event.action, event.outcome, user.id, user.email, source.ip,
    openai_chatgpt_enterprise.audit_log.action_data.email_addresses,
    openai_chatgpt_enterprise.audit_log.action_data.email_address,
    openai_chatgpt_enterprise.audit_log.action_data.role,
    openai_chatgpt_enterprise.audit_log.action_privilege,
    openai_chatgpt_enterprise.audit_log.action_result, data_stream.*

Framework: MITRE ATT&CK^TM

Tactic:
- Name: Persistence
- ID: TA0003
- Reference URL: https://attack.mitre.org/tactics/TA0003/
Technique:
- Name: Create Account
- ID: T1136
- Reference URL: https://attack.mitre.org/techniques/T1136/
Sub-technique:
- Name: Cloud Account
- ID: T1136.003
- Reference URL: https://attack.mitre.org/techniques/T1136/003/

« OpenAI ChatGPT Enterprise User Activity From High Number of Countries OpenAI ChatGPT Enterprise Workspace Feature Toggled »