LoFP LoFP / approved automation, compliance api tooling, or sso libraries that use non-browser user agents.

Techniques

Sample rules

OpenAI ChatGPT Enterprise Authentication from a Suspicious User Agent

Description

Detects successful ChatGPT Enterprise authentication events where the user agent looks scripted (for example Python, curl, Go HTTP clients, aiohttp, scrapers, or headless browsers) rather than a normal browser. Adversaries and automation often reuse stolen sessions or tokens with non-browser clients.

Detection logic

from logs-openai_chatgpt_enterprise.auth_log-* metadata _id, _version, _index
| where
    data_stream.dataset == "openai_chatgpt_enterprise.auth_log" and
    event.action in ("login_success", "native_login_success", "token_issued") and
    user_agent.original is not null and
    (
        to_lower(user_agent.original) like "*python*" or
        to_lower(user_agent.original) like "*curl/*" or
        to_lower(user_agent.original) like "*wget*" or
        to_lower(user_agent.original) like "*httpie*" or
        to_lower(user_agent.original) like "*go-http*" or
        to_lower(user_agent.original) like "*aiohttp*" or
        to_lower(user_agent.original) like "*fasthttp*" or
        to_lower(user_agent.original) like "*httpclient*" or
        to_lower(user_agent.original) like "*postmanruntime*" or
        to_lower(user_agent.original) like "*headlesschrome*" or
        to_lower(user_agent.original) like "*phantomjs*" or
        to_lower(user_agent.original) like "*selenium*" or
        to_lower(user_agent.original) like "*okhttp*" or
        to_lower(user_agent.original) like "*scrapy*" or
        to_lower(user_agent.original) like "*hydra*" or
        to_lower(user_agent.original) like "*patator*" or
        to_lower(user_agent.original) like "*metasploit*" or
        to_lower(user_agent.original) like "*curio*" or
        to_lower(user_agent.original) like "*hyper*" or
        to_lower(user_agent.original) like "*kali*" or
        to_lower(user_agent.original) like "ruby*" or
        to_lower(user_agent.original) like "node*" or
        to_lower(user_agent.original) like "undici*" or
        to_lower(user_agent.original) like "java*" or
        to_lower(user_agent.original) like "php*" or
        to_lower(user_agent.original) like "*bun/*" or
        to_lower(user_agent.original) like "*axios*"
    )
| keep _id, _version, _index, @timestamp, event.action, event.outcome, user.email, user.id, source.ip, source.geo.country_iso_code, user_agent.original, data_stream.*