OpenAI ChatGPT Enterprise High Codex MCP Tool Diversity

IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

OpenAI ChatGPT Enterprise High Codex MCP Tool Diversity

Detects a ChatGPT Enterprise Codex user invoking a high number of distinct MCP tools across multiple connectors within a 30-minute bucket. Broad tool and connector diversity in a short window can indicate compromised-account recon, unauthorized multi-system collection, or an agent rapidly enumerating organizational data sources.

Rule type: esql

Rule indices: None

Severity: medium

Risk score: 47

Runs every: 10m

Searches indices from: now-60m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

Tags:

Domain: GenAI
Platform: OpenAI
Data Source: OpenAI ChatGPT Enterprise
Service: OpenAI ChatGPT Enterprise
Use Case: Threat Detection
Use Case: UEBA
Resources: Investigation Guide
Rule Type: ES|QL
Tactic: Collection
Mitre Atlas: AML.T0053
Mitre Atlas: AML.T0085

Version: 3

Rule authors:

Elastic

Rule license: Elastic License v2

Investigation guide

edit

Triage and analysis

Investigating OpenAI ChatGPT Enterprise High Codex MCP Tool Diversity

One user invoked many distinct Codex MCP tools across multiple connectors in a 30-minute bucket. That pattern can indicate compromised-account reconnaissance, unauthorized multi-system collection, or an agent rapidly enumerating connected data sources.

Escalate when the tool set spans unexpected connectors, the actor is unusual for those systems, or nearby events show credential exposure, access-token creation, or bulk downloads. Close as a false positive for known power-user or approved automation baselines.

Possible investigation steps

Review Esql.gen_ai_tool_name_values, Esql.connector_id_values, Esql.event_count, and the time bucket.
Confirm whether the connectors are approved for that user and whether the session aligns with a known project.
Pivot to nearby app_mcp_result, prompt, share, and download events for the same user.email.
Compare against the user’s normal Codex MCP diversity over prior days.

False positive analysis

Engineers using several approved connectors in one Codex session commonly produce multi-tool bursts.
Raise the distinct-tool or distinct-connector thresholds above your normal 30-minute Codex baseline if approved power users remain noisy.

Response and remediation

Disable unauthorized connectors, revoke related OAuth links or Codex access tokens, and review data returned into the session.
If account compromise is suspected, reset sessions and hunt for follow-on exfiltration.

Setup

edit

Setup

This rule requires the OpenAI ChatGPT Enterprise integration to collect Codex compliance logs into Elasticsearch, including app_mcp_call events. Tune the distinct-tool and distinct-connector thresholds above your normal Codex baseline before broad enablement.

https://www.elastic.co/docs/reference/integrations/openai_chatgpt_enterprise

Rule query

edit

from logs-openai_chatgpt_enterprise.codex_log-*
| where
    data_stream.dataset == "openai_chatgpt_enterprise.codex_log" and
    event.action == "app_mcp_call" and
    user.email is not null and
    organization.id is not null and
    gen_ai.tool.name is not null
| eval Esql.time_bucket = date_trunc(30 minutes, @timestamp)
| stats
    Esql.gen_ai_tool_name_count_distinct = count_distinct(gen_ai.tool.name),
    Esql.connector_id_count_distinct = count_distinct(openai_chatgpt_enterprise.codex_log.event_details.tool_meta.connector_id),
    Esql.event_count = count(*),
    Esql.gen_ai_tool_name_values = values(gen_ai.tool.name),
    Esql.connector_id_values = values(openai_chatgpt_enterprise.codex_log.event_details.tool_meta.connector_id),
    Esql.timestamp_first_seen = min(@timestamp),
    Esql.timestamp_last_seen = max(@timestamp)
  by
    user.email,
    organization.id,
    Esql.time_bucket
| where
    Esql.gen_ai_tool_name_count_distinct >= 10 and
    Esql.connector_id_count_distinct >= 3
| keep
    user.email,
    organization.id,
    Esql.time_bucket,
    Esql.gen_ai_tool_name_count_distinct,
    Esql.connector_id_count_distinct,
    Esql.event_count,
    Esql.gen_ai_tool_name_values,
    Esql.connector_id_values,
    Esql.timestamp_first_seen,
    Esql.timestamp_last_seen

Framework: MITRE ATT&CK^TM

Tactic:
- Name: Collection
- ID: TA0009
- Reference URL: https://attack.mitre.org/tactics/TA0009/
Technique:
- Name: Data from Information Repositories
- ID: T1213
- Reference URL: https://attack.mitre.org/techniques/T1213/

« OpenAI ChatGPT Enterprise Google Drive Sensitive Query Burst OpenAI ChatGPT Enterprise High File Download Activity »