Techniques
Sample rules
OpenAI ChatGPT Enterprise Memory Deleted
- source: elastic
- technicques:
- T1070
Description
Detects ChatGPT Enterprise audit events that delete stored memory. Adversaries may delete memory entries to remove evidence of prior prompts, preferences, or staging instructions after misuse.
Detection logic
from logs-openai_chatgpt_enterprise.audit_log-* metadata _id, _version, _index
| where
data_stream.dataset == "openai_chatgpt_enterprise.audit_log" and
event.action == "delete_memory"
| keep
_id, _version, _index, @timestamp, event.action, user.id, user.email, source.ip,
openai_chatgpt_enterprise.audit_log.action_data.memory_id,
openai_chatgpt_enterprise.audit_log.action_data.auth_user_id,
openai_chatgpt_enterprise.audit_log.action_privilege, data_stream.*