LoFP LoFP / users intentionally share conversations for collaboration within the organization.

Techniques

Sample rules

OpenAI ChatGPT Enterprise Conversation Shared

Description

Detects ChatGPT Enterprise audit events where a conversation is shared. Sharing can expose prompts, completions, and attached files outside the original conversation participants and may be used to exfiltrate sensitive content.

Detection logic

from logs-openai_chatgpt_enterprise.audit_log-* metadata _id, _version, _index
| where
    data_stream.dataset == "openai_chatgpt_enterprise.audit_log" and
    event.action == "conversation_share"
| keep
    _id, _version, _index, @timestamp, event.action, user.id, user.email, source.ip,
    openai_chatgpt_enterprise.audit_log.action_data.conversation_id,
    openai_chatgpt_enterprise.audit_log.action_data.shared_conversation_id,
    openai_chatgpt_enterprise.audit_log.action_data.already_exists,
    openai_chatgpt_enterprise.audit_log.action_privilege, data_stream.*