LoFP LoFP / power users and legitimate multi-connector codex workflows (for example slack + github + google drive in one session) can approach these thresholds. raise `esql.gen_ai_tool_name_count_distinct` or `esql.connector_id_count_distinct` above your baseline before broad enablement.

Techniques

Sample rules

OpenAI ChatGPT Enterprise High Codex MCP Tool Diversity

Description

Detects a ChatGPT Enterprise Codex user invoking a high number of distinct MCP tools across multiple connectors within a 30-minute bucket. Broad tool and connector diversity in a short window can indicate compromised-account recon, unauthorized multi-system collection, or an agent rapidly enumerating organizational data sources.

Detection logic

from logs-openai_chatgpt_enterprise.codex_log-*
| where
    data_stream.dataset == "openai_chatgpt_enterprise.codex_log" and
    event.action == "app_mcp_call" and
    user.email is not null and
    organization.id is not null and
    gen_ai.tool.name is not null
| eval Esql.time_bucket = date_trunc(30 minutes, @timestamp)
| stats
    Esql.gen_ai_tool_name_count_distinct = count_distinct(gen_ai.tool.name),
    Esql.connector_id_count_distinct = count_distinct(openai_chatgpt_enterprise.codex_log.event_details.tool_meta.connector_id),
    Esql.event_count = count(*),
    Esql.gen_ai_tool_name_values = values(gen_ai.tool.name),
    Esql.connector_id_values = values(openai_chatgpt_enterprise.codex_log.event_details.tool_meta.connector_id),
    Esql.timestamp_first_seen = min(@timestamp),
    Esql.timestamp_last_seen = max(@timestamp)
  by
    user.email,
    organization.id,
    Esql.time_bucket
| where
    Esql.gen_ai_tool_name_count_distinct >= 10 and
    Esql.connector_id_count_distinct >= 3
| keep
    user.email,
    organization.id,
    Esql.time_bucket,
    Esql.gen_ai_tool_name_count_distinct,
    Esql.connector_id_count_distinct,
    Esql.event_count,
    Esql.gen_ai_tool_name_values,
    Esql.connector_id_values,
    Esql.timestamp_first_seen,
    Esql.timestamp_last_seen