Techniques
Sample rules
OpenAI ChatGPT Enterprise User Invite Sent
- source: elastic
- technicques:
- T1136
Description
Detects ChatGPT Enterprise audit events that invite a new user into the workspace. An adversary who compromises an administrator can invite a mailbox they control to gain durable access.
Detection logic
from logs-openai_chatgpt_enterprise.audit_log-* metadata _id, _version, _index
| where
data_stream.dataset == "openai_chatgpt_enterprise.audit_log" and
event.action == "invite_send" and
event.outcome == "success"
| keep
_id, _version, _index, @timestamp, event.action, event.outcome, user.id, user.email, source.ip,
openai_chatgpt_enterprise.audit_log.action_data.email_addresses,
openai_chatgpt_enterprise.audit_log.action_data.email_address,
openai_chatgpt_enterprise.audit_log.action_data.role,
openai_chatgpt_enterprise.audit_log.action_privilege,
openai_chatgpt_enterprise.audit_log.action_result, data_stream.*