« OpenAI ChatGPT Enterprise Unusual Codex Plugin Installed OpenAI ChatGPT Enterprise User Activity From High Number of Countries »
Elastic Docs ›Elastic Security [8.19] ›Detections and alerts ›Prebuilt rule reference

OpenAI ChatGPT Enterprise Unusual MCP App Activity

edit
IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

OpenAI ChatGPT Enterprise Unusual MCP App Activity

edit

Detects the first time a ChatGPT Enterprise MCP app name is used by a given user email within an organization in the rule history window. MCP apps connect ChatGPT to external systems and can move organizational data into third-party tools. Alerting on first-seen organization, user, and app id triples highlights new or unexpected connector usage rather than every routine approved MCP request. App name is still required in the query for investigation context.

Rule type: new_terms

Rule indices:

  • logs-openai_chatgpt_enterprise.app_log-*

Severity: medium

Risk score: 47

Runs every: 5m

Searches indices from: now-9m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

Tags:

  • Domain: GenAI
  • Platform: OpenAI
  • Data Source: OpenAI ChatGPT Enterprise
  • Service: OpenAI ChatGPT Enterprise
  • Use Case: Threat Detection
  • Use Case: UEBA
  • Resources: Investigation Guide
  • Rule Type: New Terms
  • Tactic: Collection
  • Mitre Atlas: AML.T0053

Version: 1

Rule authors:

  • Elastic

Rule license: Elastic License v2

Investigation guide

edit

Triage and analysis

Investigating OpenAI ChatGPT Enterprise Unusual MCP App Activity

First-seen MCP app name for this organization.id and user.email within the rule history window. MCP apps can move organizational data into third-party tools.

Escalate when the app is not in the approved inventory, the query looks like bulk data access, or the user recently had suspicious authentication activity. Close as a false positive when the app is approved for that user.

Possible investigation steps

  • Identify the user and app (openai_chatgpt_enterprise.app_log.app_name, app_id).
  • Review openai_chatgpt_enterprise.app_log.query and conversation identifiers when present.
  • Confirm whether the app is approved for the workspace and whether OAuth links for that app are expected.
  • Correlate with app-auth link events, conversation shares, or file downloads from the same user nearby.

False positive analysis

  • Approved MCP apps generate routine request logs. First-seen alerts often reflect a user adopting an already-approved connector.

Response and remediation

  • Disable unauthorized MCP apps, revoke linked credentials, and review conversation context for sensitive data exposure.

Setup

edit

Setup

This rule requires the OpenAI ChatGPT Enterprise integration to collect compliance logs into Elasticsearch.

https://www.elastic.co/docs/reference/integrations/openai_chatgpt_enterprise

Rule query

edit
data_stream.dataset: "openai_chatgpt_enterprise.app_log" and
    openai_chatgpt_enterprise.app_log.app_type: "MCP" and
    organization.id: * and
    user.email: * and
    openai_chatgpt_enterprise.app_log.app_name: * and
    openai_chatgpt_enterprise.app_log.app_id: *

Framework: MITRE ATT&CKTM

« OpenAI ChatGPT Enterprise Unusual Codex Plugin Installed OpenAI ChatGPT Enterprise User Activity From High Number of Countries »