LoFP LoFP / users purging old chats during workspace hygiene or retention cleanup.

Techniques

Sample rules

OpenAI ChatGPT Enterprise Excessive Conversation Deletion

Description

Detects an unusually high number of ChatGPT Enterprise conversation deletion events for the same user within a rolling 24-hour lookback. Mass deletion can indicate an attempt to remove conversation history or cover tracks after misuse.

Detection logic

from logs-openai_chatgpt_enterprise.audit_log-*
| where
    data_stream.dataset == "openai_chatgpt_enterprise.audit_log" and
    event.action == "conversation_delete" and
    user.id is not null
| stats
    Esql.event_count = count(*),
    Esql.conversation_id_values = values(openai_chatgpt_enterprise.audit_log.action_data.conversation_id),
    Esql.source_ip_values = values(source.ip),
    Esql.timestamp_first_seen = min(@timestamp),
    Esql.timestamp_last_seen = max(@timestamp)
  by user.id, user.email
| where Esql.event_count >= 20
| keep user.id, user.email, Esql.*