« OpenAI ChatGPT Enterprise Assistant Advises Credential Rotation After Suspected Exposure OpenAI ChatGPT Enterprise Codex Access Token Created »
Elastic Docs ›Elastic Security [8.19] ›Detections and alerts ›Prebuilt rule reference

OpenAI ChatGPT Enterprise Authentication from a Suspicious User Agent

edit
IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

OpenAI ChatGPT Enterprise Authentication from a Suspicious User Agent

edit

Detects successful ChatGPT Enterprise authentication events where the user agent looks scripted (for example Python, curl, Go HTTP clients, aiohttp, scrapers, or headless browsers) rather than a normal browser. Adversaries and automation often reuse stolen sessions or tokens with non-browser clients.

Rule type: esql

Rule indices: None

Severity: medium

Risk score: 47

Runs every: 5m

Searches indices from: now-9m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

Tags:

  • Domain: GenAI
  • Platform: OpenAI
  • Data Source: OpenAI ChatGPT Enterprise
  • Service: OpenAI ChatGPT Enterprise
  • Use Case: Threat Detection
  • Resources: Investigation Guide
  • Rule Type: ES|QL
  • Domain: Identity
  • Tactic: Initial Access
  • Mitre Atlas: AML.T0012

Version: 1

Rule authors:

  • Elastic

Rule license: Elastic License v2

Investigation guide

edit

Triage and analysis

Investigating OpenAI ChatGPT Enterprise Authentication from a Suspicious User Agent

A successful authentication event used a scripted user agent (for example Python, curl, Go HTTP clients, or similar) rather than a typical browser.

Escalate when the user has no approved CLI or API access, the user agent is unfamiliar, or privileged activity follows the sign-in. Close as a false positive for documented automation, compliance collectors, or SSO libraries that use non-browser clients.

Possible investigation steps

  • Confirm user_agent.original, source.ip, source.geo.country_iso_code, and the authenticated user.
  • Determine whether the account is expected to use CLI, API, or compliance automation.
  • Search for role changes, file downloads, conversation shares, or admin actions from the same user shortly after the event.
  • Compare with the user’s normal browser-based authentication history.

False positive analysis

  • Approved automation, compliance API tooling, and some SSO client libraries use non-browser user agents by design.

Response and remediation

  • Revoke sessions for the user, rotate credentials where appropriate, and inventory automation that uses that user agent.
  • If takeover is suspected, review subsequent data-access and admin activity for the same account.

Setup

edit

Setup

This rule requires the OpenAI ChatGPT Enterprise integration to collect compliance logs into Elasticsearch.

https://www.elastic.co/docs/reference/integrations/openai_chatgpt_enterprise

Rule query

edit
from logs-openai_chatgpt_enterprise.auth_log-* metadata _id, _version, _index
| where
    data_stream.dataset == "openai_chatgpt_enterprise.auth_log" and
    event.action in ("login_success", "native_login_success", "token_issued") and
    user_agent.original is not null and
    (
        to_lower(user_agent.original) like "*python*" or
        to_lower(user_agent.original) like "*curl/*" or
        to_lower(user_agent.original) like "*wget*" or
        to_lower(user_agent.original) like "*httpie*" or
        to_lower(user_agent.original) like "*go-http*" or
        to_lower(user_agent.original) like "*aiohttp*" or
        to_lower(user_agent.original) like "*fasthttp*" or
        to_lower(user_agent.original) like "*httpclient*" or
        to_lower(user_agent.original) like "*postmanruntime*" or
        to_lower(user_agent.original) like "*headlesschrome*" or
        to_lower(user_agent.original) like "*phantomjs*" or
        to_lower(user_agent.original) like "*selenium*" or
        to_lower(user_agent.original) like "*okhttp*" or
        to_lower(user_agent.original) like "*scrapy*" or
        to_lower(user_agent.original) like "*hydra*" or
        to_lower(user_agent.original) like "*patator*" or
        to_lower(user_agent.original) like "*metasploit*" or
        to_lower(user_agent.original) like "*curio*" or
        to_lower(user_agent.original) like "*hyper*" or
        to_lower(user_agent.original) like "*kali*" or
        to_lower(user_agent.original) like "ruby*" or
        to_lower(user_agent.original) like "node*" or
        to_lower(user_agent.original) like "undici*" or
        to_lower(user_agent.original) like "java*" or
        to_lower(user_agent.original) like "php*" or
        to_lower(user_agent.original) like "*bun/*" or
        to_lower(user_agent.original) like "*axios*"
    )
| keep _id, _version, _index, @timestamp, event.action, event.outcome, user.email, user.id, source.ip, source.geo.country_iso_code, user_agent.original, data_stream.*

Framework: MITRE ATT&CKTM

« OpenAI ChatGPT Enterprise Assistant Advises Credential Rotation After Suspected Exposure OpenAI ChatGPT Enterprise Codex Access Token Created »