OpenAI ChatGPT Enterprise Unusual Codex MCP Tool Call

IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

OpenAI ChatGPT Enterprise Unusual Codex MCP Tool Call

Detects the first ChatGPT Enterprise Codex MCP tool name used by a given user email within an organization in the rule history window. Codex MCP tools can query external systems and pull organizational data into an agent session. Alerting on first-seen organization, user, and tool triples highlights new or unexpected connector usage rather than every routine approved tool call.

Rule type: new_terms

Rule indices:

logs-openai_chatgpt_enterprise.codex_log-*

Severity: medium

Risk score: 47

Runs every: 5m

Searches indices from: now-9m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

Tags:

Domain: GenAI
Platform: OpenAI
Data Source: OpenAI ChatGPT Enterprise
Service: OpenAI ChatGPT Enterprise
Use Case: Threat Detection
Use Case: UEBA
Resources: Investigation Guide
Rule Type: New Terms
Tactic: Collection
Mitre Atlas: AML.T0085

Version: 3

Rule authors:

Elastic

Rule license: Elastic License v2

Investigation guide

edit

Triage and analysis

Investigating OpenAI ChatGPT Enterprise Unusual Codex MCP Tool Call

First-seen Codex MCP tool name for this organization.id and user.email within the rule history window. MCP tools can move organizational data into external systems through Codex.

Escalate when the tool or connector is not on the approved inventory, the actor is unexpected, or the same session also shows credential exposure, broad file access, or unusual shares. Close as a false positive when the tool is approved for that user or team.

Possible investigation steps

Record gen_ai.tool.name, connector or resource identifiers, and the user (user.email / user.id).
Confirm whether the MCP connector is approved in your ChatGPT Enterprise workspace inventory.
Review nearby Codex events for the same session for additional tool calls, prompts containing secrets, or access-token creation.
Search for the same tool used by other users to distinguish a new org-wide rollout from a single anomalous account.

False positive analysis

Approved engineering automation commonly introduces first-seen tool names during connector rollouts and pilot work.

Response and remediation

Disable unauthorized connectors, revoke related credentials, and review data returned into the Codex session.
If sensitive data was retrieved, treat the session as a potential exposure and follow your data-incident process.

Setup

edit

Setup

This rule requires the OpenAI ChatGPT Enterprise integration to collect compliance logs into Elasticsearch.

https://www.elastic.co/docs/reference/integrations/openai_chatgpt_enterprise

Rule query

edit

data_stream.dataset: "openai_chatgpt_enterprise.codex_log" and
    event.action: "app_mcp_call" and
    organization.id: * and
    user.email: * and
    gen_ai.tool.name: *

Framework: MITRE ATT&CK^TM

Tactic:
- Name: Collection
- ID: TA0009
- Reference URL: https://attack.mitre.org/tactics/TA0009/
Technique:
- Name: Data from Information Repositories
- ID: T1213
- Reference URL: https://attack.mitre.org/techniques/T1213/

« GitHub OAuth Application Authorized OpenAI ChatGPT Enterprise Google Drive Sensitive Query Burst »