OpenAI ChatGPT Enterprise Unusual MCP App Activity

Last updated 11 days ago on 2026-10-06

Created 11 days ago on 2026-10-06

About

Detects the first time a ChatGPT Enterprise MCP app name is used by a given user email within an organization in the rule history window. MCP apps connect ChatGPT to external systems and can move organizational data into third-party tools. Alerting on first-seen organization, user, and app id triples highlights new or unexpected connector usage rather than every routine approved MCP request. App name is still required in the query for investigation context.

Tags

Domain: GenAIPlatform: OpenAIData Source: OpenAI ChatGPT EnterpriseService: OpenAI ChatGPT EnterpriseUse Case: Threat DetectionUse Case: UEBARule Type: New TermsTactic: CollectionMitre Atlas: AML.T0053Language: kuery

Severity

medium

Risk Score

MITRE ATT&CK™

Collection (TA0009)(external, opens in a new tab or window)

↳ Data from Information Repositories (T1213)(external, opens in a new tab or window)

False Positive Examples

Approved MCP apps such as Slack or ticketing connectors generate routine traffic during normal work. First-seen alerts are common during onboarding when a user first uses an approved app.

License

Elastic License v2(external, opens in a new tab or window)

Definition

Rule Type: New Terms Rule
Integration Pack: Prebuilt Security Detection Rules
Index Patterns: logs-openai_chatgpt_enterprise.app_log-*
Related Integrations: openai_chatgpt_enterprise(external, opens in a new tab or window)
Query

✄𐘗text code block:
✄𐘗data_stream.dataset: "openai_chatgpt_enterprise.app_log" and
    openai_chatgpt_enterprise.app_log.app_type: "MCP" and
    organization.id: * and
    user.email: * and
    openai_chatgpt_enterprise.app_log.app_name: * and
    openai_chatgpt_enterprise.app_log.app_id: *

Install detection rules in Elastic Security

Detect OpenAI ChatGPT Enterprise Unusual MCP App Activity in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(external, opens in a new tab or window).