OpenAI ChatGPT Enterprise Multiple Authentication Failures

edit

IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

OpenAI ChatGPT Enterprise Multiple Authentication Failures

edit

Detects multiple failed ChatGPT Enterprise login attempts for the same user email within a short window. Password spraying or credential stuffing against enterprise accounts often precedes a successful compromise.

Rule type: esql

Rule indices: None

Severity: medium

Risk score: 47

Runs every: 15m

Searches indices from: now-1h (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

Tags:

Domain: GenAI
Platform: OpenAI
Data Source: OpenAI ChatGPT Enterprise
Service: OpenAI ChatGPT Enterprise
Use Case: Threat Detection
Resources: Investigation Guide
Rule Type: ES|QL
Domain: Identity
Use Case: Identity and Access Audit
Tactic: Credential Access

Version: 1

Rule authors:

Elastic

Rule license: Elastic License v2

Investigation guide

edit

Triage and analysis

Investigating OpenAI ChatGPT Enterprise Multiple Authentication Failures

One email produced a burst of failed ChatGPT Enterprise login attempts. That pattern can indicate password spraying, credential stuffing, or repeated guessing before a successful compromise.

Escalate when many distinct source IPs are involved, failures precede a successful login from an unfamiliar IP or user agent, or privileged activity follows. Close as a false positive for repeated typos or SSO misconfiguration from a single client.

Possible investigation steps

Review Esql.event_count, Esql.source_ip_values, and geo values on the alert.
Low IP diversity usually indicates one device or egress. High diversity suggests distributed automation.
Search for successful logins for the same email immediately after the failure burst.
Correlate with role changes, invites, or data-access events if a successful login follows.

False positive analysis

Users mistyping passwords or temporary SSO misconfiguration can generate short clusters of failures from one IP and user agent.

Response and remediation

If compromise is suspected, lock or reset the account, revoke sessions, and review subsequent successful authentication and audit activity.

Setup

edit

Setup

This rule requires the OpenAI ChatGPT Enterprise integration to collect compliance logs into Elasticsearch.

https://www.elastic.co/docs/reference/integrations/openai_chatgpt_enterprise

Rule query

edit

from logs-openai_chatgpt_enterprise.auth_log-*
| where
    data_stream.dataset == "openai_chatgpt_enterprise.auth_log" and
    event.action == "login_failed" and
    user.email is not null
| stats
    Esql.event_count = count(*),
    Esql.source_ip_values = values(source.ip),
    Esql.source_geo_country_iso_code_values = values(source.geo.country_iso_code),
    Esql.user_agent_original_values = values(user_agent.original),
    Esql.timestamp_first_seen = min(@timestamp),
    Esql.timestamp_last_seen = max(@timestamp)
  by user.email
| where Esql.event_count >= 10
| keep user.email, Esql.*

Framework: MITRE ATT&CK^TM

Tactic:
- Name: Credential Access
- ID: TA0006
- Reference URL: https://attack.mitre.org/tactics/TA0006/
Technique:
- Name: Brute Force
- ID: T1110
- Reference URL: https://attack.mitre.org/techniques/T1110/

« OpenAI ChatGPT Enterprise Conversation Message Containing Credentials OpenAI ChatGPT Enterprise Codex Security Scan Configuration Changed »