LoFP LoFP / administrators deleting expired workspace log archives under an approved retention policy.

Techniques

Sample rules

OpenAI ChatGPT Enterprise Workspace Log File Deleted

Description

Detects ChatGPT Enterprise audit events where a workspace compliance log file is deleted (delete_workspace_log_file). Adversaries with privileged access may delete exported audit or conversation log archives to remove evidence from compliance workflows and hinder investigation.

Detection logic

from logs-openai_chatgpt_enterprise.audit_log-* metadata _id, _version, _index
| where
    data_stream.dataset == "openai_chatgpt_enterprise.audit_log" and
    event.action == "delete_workspace_log_file" and
    openai_chatgpt_enterprise.audit_log.actor.type == "ACCOUNT_USER"
| keep
    _id, _version, _index, @timestamp, event.action, user.id, user.email, source.ip,
    openai_chatgpt_enterprise.audit_log.action_data.event_type,
    openai_chatgpt_enterprise.audit_log.action_data.log_file_id,
    openai_chatgpt_enterprise.audit_log.action_privilege,
    openai_chatgpt_enterprise.audit_log.actor.type, data_stream.*