LoFP LoFP / discussions of certificate or tls rotation can match loosely worded replies; this rule requires secret-family terms plus exposure or recognition phrasing to reduce those cases.

Techniques

Sample rules

OpenAI ChatGPT Enterprise Assistant Advises Credential Rotation After Suspected Exposure

Description

Detects ChatGPT Enterprise assistant messages that recognize likely exposed secrets in chat and advise rotating, revoking, regenerating, invalidating, or deactivating credentials (API keys, access keys, passwords, tokens, and similar). Users or adversaries who paste live secrets into conversations create credential-exposure risk; the assistant’s rotation advice is a strong signal that a secret was present in the prior turns.

Detection logic

from logs-openai_chatgpt_enterprise.conversation_message-* metadata _id, _version, _index
| where
    data_stream.dataset == "openai_chatgpt_enterprise.conversation_message" and
    openai_chatgpt_enterprise.conversation_message.message.author.type == "assistant" and
    message is not null
| eval Esql.message_text = to_lower(message)
| where
    (
        Esql.message_text like "*rotate*" or
        Esql.message_text like "*revoke*" or
        Esql.message_text like "*regenerate*" or
        Esql.message_text like "*invalidate*" or
        Esql.message_text like "*deactivate*"
    ) and
    (
        Esql.message_text like "*api key*" or
        Esql.message_text like "*access key*" or
        Esql.message_text like "*secret access key*" or
        Esql.message_text like "*aws secret*" or
        Esql.message_text like "*credential*" or
        Esql.message_text like "*password*" or
        Esql.message_text like "*secret key*" or
        Esql.message_text like "*auth token*"
    ) and
    (
        Esql.message_text like "*looks like*" or
        Esql.message_text like "*appears to be*" or
        Esql.message_text like "*you shared*" or
        Esql.message_text like "*you pasted*" or
        Esql.message_text like "*you posted*" or
        Esql.message_text like "*you provided*" or
        Esql.message_text like "*exposed*" or
        Esql.message_text like "*leaked*" or
        Esql.message_text like "*compromised*" or
        Esql.message_text like "*for security*" or
        Esql.message_text like "*treat them as exposed*" or
        Esql.message_text like "*treat it as exposed*"
    )
| keep
    _id,
    _version,
    _index,
    @timestamp,
    message,
    user.id,
    user.email,
    organization.id,
    openai_chatgpt_enterprise.conversation_message.conversation.id,
    openai_chatgpt_enterprise.conversation_message.conversation.title,
    openai_chatgpt_enterprise.conversation_message.message.author.type,
    openai_chatgpt_enterprise.conversation_message.message.id,
    data_stream.*