LoFP LoFP / operations teams create approved triggers for recurring agent workflows.

Techniques

Sample rules

OpenAI ChatGPT Enterprise Custom Agent Trigger Changed

Description

Detects ChatGPT Enterprise custom-agent events that create or update a trigger. Triggers can schedule or event-drive agent runs without interactive user presence, enabling persistence and automation abuse.

Detection logic

from logs-openai_chatgpt_enterprise.custom_agents_log-* metadata _id, _version, _index
| where
    data_stream.dataset == "openai_chatgpt_enterprise.custom_agents_log" and
    event.action in ("trigger_created", "trigger_updated")
| keep
    _id, _version, _index, @timestamp, event.action, user.id, user.email,
    gen_ai.agent.id,
    openai_chatgpt_enterprise.custom_agents_log.client_id,
    openai_chatgpt_enterprise.custom_agents_log.event_details.trigger_fields.required_actions,
    data_stream.*