LoFP LoFP / approved automation that uses chatgpt's slack connector for triage or knowledge lookup. raise the distinct-query threshold if those roles remain noisy.

Techniques

Sample rules

OpenAI ChatGPT Enterprise Slack Query Burst

Description

Detects a ChatGPT Enterprise user issuing ten or more distinct Slack app search queries in a five-minute bucket. Adversaries who abuse a linked Slack connector after session compromise often run rapid multi-query searches across channels and messages to locate sensitive content before collection or exfiltration.

Detection logic

from logs-openai_chatgpt_enterprise.app_log-*
| where
    data_stream.dataset == "openai_chatgpt_enterprise.app_log" and
    openai_chatgpt_enterprise.app_log.app_name == "Slack" and
    openai_chatgpt_enterprise.app_log.log_type == "request" and
    openai_chatgpt_enterprise.app_log.query is not null and
    user.email is not null
| eval Esql.time_bucket = date_trunc(5 minutes, @timestamp)
| stats
    Esql.query_count_distinct = count_distinct(openai_chatgpt_enterprise.app_log.query),
    Esql.event_count = count(*),
    Esql.query_values = values(openai_chatgpt_enterprise.app_log.query),
    Esql.timestamp_first_seen = min(@timestamp),
    Esql.timestamp_last_seen = max(@timestamp)
  by
    user.email,
    organization.id,
    Esql.time_bucket
| where Esql.query_count_distinct >= 10
| keep
    user.email,
    organization.id,
    Esql.time_bucket,
    Esql.query_count_distinct,
    Esql.event_count,
    Esql.query_values,
    Esql.timestamp_first_seen,
    Esql.timestamp_last_seen