LoFP LoFP / documentation samples and example keys can match token patterns. confirm the value is live before rotating it.

Techniques

Sample rules

OpenAI ChatGPT Enterprise Conversation Message Containing Credentials

Description

Detects ChatGPT Enterprise conversation messages whose text matches known credential patterns (cloud keys, GitHub tokens, private keys, Slack/SendGrid tokens, Stripe/OpenAI/Anthropic keys, Vault/Docker tokens, JWTs, or Azure storage keys). Secrets pasted into chats can be retained in compliance logs and model context.

Detection logic

from logs-openai_chatgpt_enterprise.conversation_message-* metadata _id, _version, _index
| eval Esql.message_text = coalesce(message, "")
| where
    data_stream.dataset == "openai_chatgpt_enterprise.conversation_message" and
    Esql.message_text is not null and
    Esql.message_text != "" and
    not Esql.message_text like "*AKIAIOSFODNN7EXAMPLE*" and
    not Esql.message_text like "*ASIAIOSFODNN7EXAMPLE*" and
    not Esql.message_text like "*ghp_example*" and
    not Esql.message_text like "*sk-ant-api03-test*" and
    (
        Esql.message_text rlike """.*(AKIA|ASIA)[A-Z0-9]{16}.*""" or
        Esql.message_text rlike """.*gh[pousr]_[A-Za-z0-9]{36}.*""" or
        Esql.message_text rlike """.*github_pat_[A-Za-z0-9_]+.*""" or
        Esql.message_text rlike """.*-----BEGIN [A-Z ]*PRIVATE KEY-----.*""" or
        Esql.message_text rlike """.*xox[baprs]-[0-9]+-[0-9]+-[A-Za-z0-9]+.*""" or
        Esql.message_text rlike """.*sk_live_[A-Za-z0-9]+.*""" or
        Esql.message_text rlike """.*AIza[-A-Za-z0-9_]+.*""" or
        Esql.message_text rlike """.*npm_[A-Za-z0-9]{36}.*""" or
        Esql.message_text rlike """.*sk-ant-[A-Za-z0-9-]+.*""" or
        Esql.message_text rlike """.*sk-[A-Za-z0-9]{20,}.*""" or
        Esql.message_text rlike """.*hvs[.][A-Za-z0-9]+.*""" or
        Esql.message_text rlike """.*dckr_pat_[-A-Za-z0-9_]+.*""" or
        Esql.message_text rlike """.*SG[.][-A-Za-z0-9_]+[.][-A-Za-z0-9_]+.*""" or
        Esql.message_text rlike """.*(AccountKey=|SharedAccessKey=)[-A-Za-z0-9+/=]+.*""" or
        Esql.message_text rlike """.*eyJ[-A-Za-z0-9_]+[.]eyJ[-A-Za-z0-9_]+[.][-A-Za-z0-9_]+.*"""
    )
| keep
    _id, _version, _index, @timestamp, message, user.id, user.email,
    openai_chatgpt_enterprise.conversation_message.conversation.id,
    openai_chatgpt_enterprise.conversation_message.conversation.title,
    openai_chatgpt_enterprise.conversation_message.message.author.type,
    openai_chatgpt_enterprise.conversation_message.message.id,
    data_stream.*