LoFP LoFP / platform teams publish approved custom agents during workspace rollouts.

Techniques

Sample rules

OpenAI ChatGPT Enterprise Custom Agent Published

Description

Detects ChatGPT Enterprise custom-agent publish events (agent_published). Publishing an agent with connectors, skills, or store visibility can establish durable automation and broaden data access beyond the original user.

Detection logic

from logs-openai_chatgpt_enterprise.custom_agents_log-* metadata _id, _version, _index
| where
    data_stream.dataset == "openai_chatgpt_enterprise.custom_agents_log" and
    event.action == "agent_published"
| keep
    _id, _version, _index, @timestamp, event.action, user.id, user.email,
    gen_ai.agent.id,
    openai_chatgpt_enterprise.custom_agents_log.client_id,
    openai_chatgpt_enterprise.custom_agents_log.event_details.publish_type,
    openai_chatgpt_enterprise.custom_agents_log.event_details.release_name,
    openai_chatgpt_enterprise.custom_agents_log.event_details.agent_fields.store_visible,
    openai_chatgpt_enterprise.custom_agents_log.event_details.agent_fields.workspace_capability,
    data_stream.*