OpenAI ChatGPT Enterprise Memory Deleted

IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

OpenAI ChatGPT Enterprise Memory Deleted

Detects ChatGPT Enterprise audit events that delete stored memory. Adversaries may delete memory entries to remove evidence of prior prompts, preferences, or staging instructions after misuse.

Rule type: esql

Rule indices: None

Severity: medium

Risk score: 47

Runs every: 5m

Searches indices from: now-9m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

Tags:

Domain: GenAI
Platform: OpenAI
Data Source: OpenAI ChatGPT Enterprise
Service: OpenAI ChatGPT Enterprise
Use Case: Threat Detection
Resources: Investigation Guide
Rule Type: ES|QL
Tactic: Defense Evasion
Mitre Atlas: AML.T0092

Version: 1

Rule authors:

Elastic

Rule license: Elastic License v2

Investigation guide

edit

Triage and analysis

Investigating OpenAI ChatGPT Enterprise Memory Deleted

A ChatGPT Enterprise memory entry was deleted. Memory deletion can remove persisted context that would otherwise help explain prior conversations or automated behavior.

Escalate when deletion follows unusual chat activity, credential exposure, or other defense-evasion signals from the same user. Close as a false positive for routine user-driven memory cleanup.

Possible investigation steps

Identify the user and memory identifiers on the alert.
Review the user’s recent conversation and Codex activity for sensitive content or policy-violating use.
Correlate with mass conversation deletion, shares, or downloads nearby.
Ask the user whether the deletion was intentional only after reviewing surrounding activity.

False positive analysis

Users commonly delete individual memories while managing personalization settings.

Response and remediation

Preserve remaining audit history and investigate the actor’s recent conversations if the deletion appears tied to concealment.

Setup

edit

Setup

This rule requires the OpenAI ChatGPT Enterprise integration to collect compliance logs into Elasticsearch.

https://www.elastic.co/docs/reference/integrations/openai_chatgpt_enterprise

Rule query

edit

from logs-openai_chatgpt_enterprise.audit_log-* metadata _id, _version, _index
| where
    data_stream.dataset == "openai_chatgpt_enterprise.audit_log" and
    event.action == "delete_memory"
| keep
    _id, _version, _index, @timestamp, event.action, user.id, user.email, source.ip,
    openai_chatgpt_enterprise.audit_log.action_data.memory_id,
    openai_chatgpt_enterprise.audit_log.action_data.auth_user_id,
    openai_chatgpt_enterprise.audit_log.action_privilege, data_stream.*

Framework: MITRE ATT&CK^TM

Tactic:
- Name: Defense Evasion
- ID: TA0005
- Reference URL: https://attack.mitre.org/tactics/TA0005/
Technique:
- Name: Indicator Removal
- ID: T1070
- Reference URL: https://attack.mitre.org/techniques/T1070/

« OpenAI ChatGPT Enterprise High File Download Activity OpenAI ChatGPT Enterprise Multiple Authentication Failures »