OpenAI ChatGPT Enterprise Workspace Feature Toggled

IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

OpenAI ChatGPT Enterprise Workspace Feature Toggled

Detects ChatGPT Enterprise audit events that toggle a workspace feature flag (for example GPT sharing). Adversaries may enable sharing or weaken controls to persist access or broaden data exposure.

Rule type: esql

Rule indices: None

Severity: medium

Risk score: 47

Runs every: 5m

Searches indices from: now-9m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

Tags:

Domain: GenAI
Platform: OpenAI
Data Source: OpenAI ChatGPT Enterprise
Service: OpenAI ChatGPT Enterprise
Use Case: Threat Detection
Resources: Investigation Guide
Rule Type: ES|QL
Tactic: Defense Evasion
Tactic: Persistence
Mitre Atlas: AML.T0081

Version: 1

Rule authors:

Elastic

Rule license: Elastic License v2

Investigation guide

edit

Triage and analysis

Investigating OpenAI ChatGPT Enterprise Workspace Feature Toggled

A workspace feature flag changed. Adversaries may enable sharing or weaken controls to broaden data exposure or persist access.

Escalate when the feature increases sharing or reduces security controls without an approved change. Close as a false positive for documented rollout toggles by administrators.

Possible investigation steps

Identify the actor and which feature was enabled or disabled.
Determine whether the change increases sharing, external visibility, or weakens security controls.
Correlate with other admin actions by the same actor, such as role changes, invites, or exports.
Confirm whether a change request authorized the toggle.

False positive analysis

Administrators intentionally enable or disable workspace features during approved rollouts.

Response and remediation

Revert unauthorized feature changes and review other admin actions by the same actor.

Setup

edit

Setup

This rule requires the OpenAI ChatGPT Enterprise integration to collect compliance logs into Elasticsearch.

https://www.elastic.co/docs/reference/integrations/openai_chatgpt_enterprise

Rule query

edit

from logs-openai_chatgpt_enterprise.audit_log-* metadata _id, _version, _index
| where
    data_stream.dataset == "openai_chatgpt_enterprise.audit_log" and
    event.action == "workspace_toggle_feature"
| keep
    _id, _version, _index, @timestamp, event.action, user.id, user.email, source.ip,
    openai_chatgpt_enterprise.audit_log.action_data.feature,
    openai_chatgpt_enterprise.audit_log.action_data.value,
    openai_chatgpt_enterprise.audit_log.action_data.value_bool,
    openai_chatgpt_enterprise.audit_log.action_privilege, data_stream.*

Framework: MITRE ATT&CK^TM

Tactic:
- Name: Defense Evasion
- ID: TA0005
- Reference URL: https://attack.mitre.org/tactics/TA0005/
Technique:
- Name: Impair Defenses
- ID: T1562
- Reference URL: https://attack.mitre.org/techniques/T1562/

« OpenAI ChatGPT Enterprise User Invite Sent OpenAI ChatGPT Enterprise Workspace Log File Deleted »