LoFP LoFP / users downloading many attachments during legitimate research or migration work.

Techniques

Sample rules

OpenAI ChatGPT Enterprise High File Download Activity

Description

Detects a high number of ChatGPT Enterprise file download audit events for the same user within a rolling 24-hour lookback. Bulk downloads can indicate staging of conversation attachments or workspace files for exfiltration.

Detection logic

from logs-openai_chatgpt_enterprise.audit_log-*
| where
    data_stream.dataset == "openai_chatgpt_enterprise.audit_log" and
    event.action == "file_download" and
    user.id is not null
| stats
    Esql.event_count = count(*),
    Esql.file_id_values = values(openai_chatgpt_enterprise.audit_log.action_data.file_id),
    Esql.file_format_values = values(openai_chatgpt_enterprise.audit_log.action_data.file_format),
    Esql.source_ip_values = values(source.ip),
    Esql.timestamp_first_seen = min(@timestamp),
    Esql.timestamp_last_seen = max(@timestamp)
  by user.id, user.email
| where Esql.event_count >= 30
| keep user.id, user.email, Esql.*