LoFP LoFP / security engineering teams legitimately onboard repositories and tune scan lookback windows.

Techniques

Sample rules

OpenAI ChatGPT Enterprise Codex Security Scan Configuration Changed

Description

Detects ChatGPT Enterprise Codex security-log events that create or update a repository scan configuration. Changing scan scope, lookback, or notification rules can weaken secrets scanning coverage or redirect findings.

Detection logic

from logs-openai_chatgpt_enterprise.codex_security_log-* metadata _id, _version, _index
| where
    data_stream.dataset == "openai_chatgpt_enterprise.codex_security_log" and
    event.action in ("scan_configuration_created", "scan_configuration_updated")
| keep
    _id, _version, _index, @timestamp, event.action, user.id, user.email,
    openai_chatgpt_enterprise.codex_security_log.client_id,
    openai_chatgpt_enterprise.codex_security_log.workspace_id,
    openai_chatgpt_enterprise.codex_security_log.event_details.scan_configuration_id,
    openai_chatgpt_enterprise.codex_security_log.event_details.scan_configuration_fields.repo_url,
    openai_chatgpt_enterprise.codex_security_log.event_details.scan_configuration_fields.scan_type,
    openai_chatgpt_enterprise.codex_security_log.event_details.scan_configuration_fields.state,
    openai_chatgpt_enterprise.codex_security_log.event_details.scan_configuration_fields.lookback_days,
    data_stream.*