LoFP LoFP / approved mcp apps such as slack or ticketing connectors generate routine traffic during normal work. first-seen alerts are common during onboarding when a user first uses an approved app.

Techniques

Sample rules

OpenAI ChatGPT Enterprise Unusual MCP App Activity

Description

Detects the first time a ChatGPT Enterprise MCP app name is used by a given user email within an organization in the rule history window. MCP apps connect ChatGPT to external systems and can move organizational data into third-party tools. Alerting on first-seen organization, user, and app id triples highlights new or unexpected connector usage rather than every routine approved MCP request. App name is still required in the query for investigation context.

Detection logic

data_stream.dataset: "openai_chatgpt_enterprise.app_log" and
    openai_chatgpt_enterprise.app_log.app_type: "MCP" and
    organization.id: * and
    user.email: * and
    openai_chatgpt_enterprise.app_log.app_name: * and
    openai_chatgpt_enterprise.app_log.app_id: *