OpenAI ChatGPT Enterprise Slack Query Burst

IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

OpenAI ChatGPT Enterprise Slack Query Burst

Detects a ChatGPT Enterprise user issuing ten or more distinct Slack app search queries in a five-minute bucket. Adversaries who abuse a linked Slack connector after session compromise often run rapid multi-query searches across channels and messages to locate sensitive content before collection or exfiltration.

Rule type: esql

Rule indices: None

Severity: medium

Risk score: 47

Runs every: 5m

Searches indices from: now-30m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

Tags:

Domain: GenAI
Platform: OpenAI
Data Source: OpenAI ChatGPT Enterprise
Service: OpenAI ChatGPT Enterprise
Use Case: Threat Detection
Resources: Investigation Guide
Rule Type: ES|QL
Tactic: Collection
Tactic: Discovery
Mitre Atlas: AML.T0053
Mitre Atlas: AML.T0085

Version: 1

Rule authors:

Elastic

Rule license: Elastic License v2

Investigation guide

edit

Triage and analysis

Investigating OpenAI ChatGPT Enterprise Slack Query Burst

One user ran ten or more distinct Slack app searches in five minutes. That pattern can indicate using ChatGPT’s Slack connector to enumerate channels or messages at volume for collection.

Escalate when queries look like bulk discovery (many channels, sequential refinements, sensitive keywords), downloads or shares follow, or the actor is unexpected. Close as a false positive for approved incident-response or support search bursts.

Possible investigation steps

Review Esql.query_values, Esql.query_count_distinct, and Esql.event_count on the alert.
Correlate with nearby conversation messages asking ChatGPT to search Slack or retrieve messages or files.
Check subsequent file downloads, conversation shares, or Codex MCP Slack tool calls from the same user.
Confirm whether the Slack connector is approved for that user and whether the search volume matches their role.

False positive analysis

Support and incident-response teams commonly refine Slack searches many times in one session.
Raise Esql.query_count_distinct (default 10) above your baseline if heavy Slack-connector users remain noisy.

Response and remediation

If unauthorized, revoke Slack connector access for the user, review retrieved messages and files, and treat exposed content per your data-incident process.
Hunt for follow-on downloads, shares, or external forwarding of the matched content.

Setup

edit

Setup

This rule requires the OpenAI ChatGPT Enterprise integration to collect app_log events for the Slack app, including request logs with openai_chatgpt_enterprise.app_log.query populated.

https://www.elastic.co/docs/reference/integrations/openai_chatgpt_enterprise

Rule query

edit

from logs-openai_chatgpt_enterprise.app_log-*
| where
    data_stream.dataset == "openai_chatgpt_enterprise.app_log" and
    openai_chatgpt_enterprise.app_log.app_name == "Slack" and
    openai_chatgpt_enterprise.app_log.log_type == "request" and
    openai_chatgpt_enterprise.app_log.query is not null and
    user.email is not null
| eval Esql.time_bucket = date_trunc(5 minutes, @timestamp)
| stats
    Esql.query_count_distinct = count_distinct(openai_chatgpt_enterprise.app_log.query),
    Esql.event_count = count(*),
    Esql.query_values = values(openai_chatgpt_enterprise.app_log.query),
    Esql.timestamp_first_seen = min(@timestamp),
    Esql.timestamp_last_seen = max(@timestamp)
  by
    user.email,
    organization.id,
    Esql.time_bucket
| where Esql.query_count_distinct >= 10
| keep
    user.email,
    organization.id,
    Esql.time_bucket,
    Esql.query_count_distinct,
    Esql.event_count,
    Esql.query_values,
    Esql.timestamp_first_seen,
    Esql.timestamp_last_seen

Framework: MITRE ATT&CK^TM

Tactic:
- Name: Collection
- ID: TA0009
- Reference URL: https://attack.mitre.org/tactics/TA0009/
Technique:
- Name: Data from Information Repositories
- ID: T1213
- Reference URL: https://attack.mitre.org/techniques/T1213/
Tactic:
- Name: Discovery
- ID: TA0007
- Reference URL: https://attack.mitre.org/tactics/TA0007/
Technique:
- Name: File and Directory Discovery
- ID: T1083
- Reference URL: https://attack.mitre.org/techniques/T1083/

« OpenAI ChatGPT Enterprise Unusual MCP App Activity OpenAI ChatGPT Enterprise Workspace Log Files Accessed »