LoFP LoFP / security and compliance teams download workspace logs for investigations, siem validation, or regulatory requests.

Techniques

Sample rules

OpenAI ChatGPT Enterprise Workspace Log Files Accessed

Description

Detects ChatGPT Enterprise audit events where workspace compliance log files are listed or downloaded. Attackers pull audit and conversation exports to understand defender visibility or stage sensitive transcript data before further abuse.

Detection logic

from logs-openai_chatgpt_enterprise.audit_log-* metadata _id, _version, _index
| where
    data_stream.dataset == "openai_chatgpt_enterprise.audit_log" and
    event.action in ("download_workspace_log_file", "list_workspace_log_files") and
    openai_chatgpt_enterprise.audit_log.actor.type == "ACCOUNT_USER"
| keep
    _id, _version, _index, @timestamp, event.action, user.id, user.email, source.ip,
    openai_chatgpt_enterprise.audit_log.action_data.event_type,
    openai_chatgpt_enterprise.audit_log.action_data.log_file_id,
    openai_chatgpt_enterprise.audit_log.action_privilege,
    openai_chatgpt_enterprise.audit_log.actor.type, data_stream.*