LoFP LoFP / users mistype passwords repeatedly or sso misconfiguration can generate clusters of failed logins.

Techniques

Sample rules

OpenAI ChatGPT Enterprise Multiple Authentication Failures

Description

Detects multiple failed ChatGPT Enterprise login attempts for the same user email within a short window. Password spraying or credential stuffing against enterprise accounts often precedes a successful compromise.

Detection logic

from logs-openai_chatgpt_enterprise.auth_log-*
| where
    data_stream.dataset == "openai_chatgpt_enterprise.auth_log" and
    event.action == "login_failed" and
    user.email is not null
| stats
    Esql.event_count = count(*),
    Esql.source_ip_values = values(source.ip),
    Esql.source_geo_country_iso_code_values = values(source.geo.country_iso_code),
    Esql.user_agent_original_values = values(user_agent.original),
    Esql.timestamp_first_seen = min(@timestamp),
    Esql.timestamp_last_seen = max(@timestamp)
  by user.email
| where Esql.event_count >= 10
| keep user.email, Esql.*