LoFP LoFP / teams intentionally publish gpts or skills for approved internal or partner use under change management.

Techniques

Sample rules

OpenAI ChatGPT Enterprise Resources Sharing Updated

Description

Detects ChatGPT Enterprise audit events that publish a GPT or update sharing for GPTs, skills, or projects (gpt_publish, update_sharing, skill_share, project_update_sharing). Broadening share scope can expose custom instructions, tools, or proprietary agent configurations beyond the original audience.

Detection logic

from logs-openai_chatgpt_enterprise.audit_log-* metadata _id, _version, _index
| where
    data_stream.dataset == "openai_chatgpt_enterprise.audit_log" and
    event.action in ("gpt_publish", "update_sharing", "skill_share", "project_update_sharing")
| keep
    _id, _version, _index, @timestamp, event.action, user.id, user.email, source.ip,
    openai_chatgpt_enterprise.audit_log.action_data.gpt_id,
    openai_chatgpt_enterprise.audit_log.action_data.agent_id,
    openai_chatgpt_enterprise.audit_log.action_data.skill_id,
    openai_chatgpt_enterprise.audit_log.action_data.shared_to.recipient_type,
    openai_chatgpt_enterprise.audit_log.action_data.third_party_gizmo_id,
    openai_chatgpt_enterprise.audit_log.action_privilege, data_stream.*