LoFP LoFP / administrators intentionally enable or disable workspace features during rollout.

Techniques

Sample rules

OpenAI ChatGPT Enterprise Workspace Feature Toggled

Description

Detects ChatGPT Enterprise audit events that toggle a workspace feature flag (for example GPT sharing). Adversaries may enable sharing or weaken controls to persist access or broaden data exposure.

Detection logic

from logs-openai_chatgpt_enterprise.audit_log-* metadata _id, _version, _index
| where
    data_stream.dataset == "openai_chatgpt_enterprise.audit_log" and
    event.action == "workspace_toggle_feature"
| keep
    _id, _version, _index, @timestamp, event.action, user.id, user.email, source.ip,
    openai_chatgpt_enterprise.audit_log.action_data.feature,
    openai_chatgpt_enterprise.audit_log.action_data.value,
    openai_chatgpt_enterprise.audit_log.action_data.value_bool,
    openai_chatgpt_enterprise.audit_log.action_privilege, data_stream.*