diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index 5784ed08f27..c0eabfc2be8 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -434,6 +434,7 @@
/packages/openai/data_stream/moderations @elastic/obs-infraobs-integrations
/packages/openai/data_stream/rate_limits @elastic/obs-infraobs-integrations
/packages/openai/data_stream/vector_stores @elastic/obs-infraobs-integrations
+/packages/openai_chatgpt_enterprise @elastic/security-service-integrations
/packages/opencanary @elastic/security-service-integrations @elastic/sit-crest-contractors
/packages/oracle @elastic/obs-infraobs-integrations
/packages/oracle_otel @elastic/obs-infraobs-integrations
diff --git a/packages/openai_chatgpt_enterprise/_dev/build/build.yml b/packages/openai_chatgpt_enterprise/_dev/build/build.yml
new file mode 100644
index 00000000000..ac5efe47b5c
--- /dev/null
+++ b/packages/openai_chatgpt_enterprise/_dev/build/build.yml
@@ -0,0 +1,3 @@
+dependencies:
+ ecs:
+ reference: git@v9.4.0
diff --git a/packages/openai_chatgpt_enterprise/_dev/build/docs/README.md b/packages/openai_chatgpt_enterprise/_dev/build/docs/README.md
new file mode 100644
index 00000000000..959033563c2
--- /dev/null
+++ b/packages/openai_chatgpt_enterprise/_dev/build/docs/README.md
@@ -0,0 +1,110 @@
+# OpenAI ChatGPT Enterprise Integration for Elastic
+
+## Overview
+
+[OpenAI ChatGPT Enterprise](https://openai.com/chatgpt/enterprise/) is the enterprise offering of ChatGPT, providing workspace administration, security controls, and compliance capabilities for organizations. The [Compliance Logs Platform](https://help.openai.com/en/articles/9261474-compliance-api-for-enterprise-customers) exposes the compliance events generated across a workspace or organization, including administrative activity, authentication, application access, and Codex activity.
+
+This integration for Elastic allows you to collect ChatGPT Enterprise compliance logs using the OpenAI Compliance Logs Platform API, then visualize the data in Kibana.
+
+### Compatibility
+
+This integration is compatible with the OpenAI Compliance Logs Platform API for ChatGPT Enterprise customers.
+
+### How it works
+
+This integration periodically queries the OpenAI Compliance Logs Platform API to retrieve compliance logs. Collection is a two-step (chained) process: the integration first lists the available log files for the configured event type, then downloads each log file and emits every JSON Lines record it contains as an individual event.
+
+## What data does this integration collect?
+
+This integration collects log messages of the following type:
+
+- `Audit Logs`: Collect administrative and workspace audit activity (event type: `AUDIT_LOG`) from the OpenAI Compliance Logs Platform. Each audit event captures the action performed, the acting principal, the outcome, and request metadata such as client IP and user agent.
+
+### Supported use cases
+
+Bringing OpenAI ChatGPT Enterprise Audit Logs into Elastic gives security and compliance teams a searchable, correlatable record of administrative and workspace activity. Audit events describe who performed which action, on which resource, from where, and whether the action succeeded, was blocked, or failed.
+
+Use the `audit_log` data stream to monitor privileged administrative actions (role changes, application access grants, feature toggles, invitations, and workspace policy updates), investigate suspicious activity by user, IP, or geography, and track outcome trends over time. Bundled dashboards summarize activity volume, top actions, top users, action outcomes, and source geography for day-to-day monitoring and investigation.
+
+## What do I need to use this integration?
+
+### From OpenAI
+
+To collect data through the OpenAI Compliance Logs Platform API, you need a **Compliance API key** authorized for enterprise logs and the **Workspace ID** or **Organization ID** whose compliance logs you want to collect.
+
+1. Ensure your account has access to the [Compliance API for enterprise customers](https://help.openai.com/en/articles/9261474-compliance-api-for-enterprise-customers).
+2. Generate a **Compliance API key** authorized for enterprise logs.
+3. Obtain the **Workspace ID** (when Scope is `workspace`) or the **Organization ID** (when Scope is `organization`) whose logs will be collected.
+4. Store these values securely for use in the integration configuration.
+
+## How do I deploy this integration?
+
+This integration supports both Elastic Agentless-based and Agent-based installations.
+
+### Agent-based deployment
+
+Elastic Agent must be installed. For more details, check the Elastic Agent [installation instructions](docs-content://reference/fleet/install-elastic-agents.md). You can install only one Elastic Agent per host.
+
+Elastic Agent is required to stream data from the OpenAI Compliance Logs Platform API and ship the data to Elastic, where the events will then be processed via the integration's ingest pipelines.
+
+### Agentless deployment
+
+Agentless deployments are only supported in Elastic Serverless and Elastic Cloud environments. Agentless deployments provide a means to ingest data while avoiding the orchestration, management, and maintenance needs associated with standard ingest infrastructure. Using an agentless deployment makes manual agent deployment unnecessary, allowing you to focus on your data instead of the agent that collects it.
+
+For more information, refer to [Agentless integrations](https://www.elastic.co/guide/en/serverless/current/security-agentless-integrations.html) and [Agentless integrations FAQ](https://www.elastic.co/guide/en/serverless/current/agentless-integration-troubleshooting.html)
+
+### Configure
+
+1. In the top search bar in Kibana, search for **Integrations**.
+2. In the search bar, type **OpenAI ChatGPT Enterprise**.
+3. Select the **OpenAI ChatGPT Enterprise** integration from the search results.
+4. Select **Add OpenAI ChatGPT Enterprise** to add the integration.
+5. Enable and configure the collection method:
+
+ * To **Collect ChatGPT Enterprise compliance logs**, you'll need to:
+
+ - Configure the **URL** and **Compliance API key**.
+ - Set the **Scope** (`workspace` or `organization`) and the corresponding **Workspace / Organization ID**.
+ - Adjust the integration configuration parameters if required, including the Interval, Initial Interval, and HTTP Client Timeout to enable data collection.
+
+6. Select **Save and continue** to save the integration.
+
+### Validation
+
+#### Dashboard populated
+
+1. In the top search bar in Kibana, search for **Dashboards**.
+2. In the search bar, type **OpenAI ChatGPT Enterprise**, and verify the dashboard information is populated.
+
+## Troubleshooting
+
+For help with Elastic ingest tools, check [Common problems](https://www.elastic.co/docs/troubleshoot/ingest/fleet/common-problems).
+
+## Scaling
+
+For more information on architectures that can be used for scaling this integration, check the [Ingest Architectures](https://www.elastic.co/docs/manage-data/ingest/ingest-reference-architectures) documentation.
+
+## Reference
+
+### Audit Logs
+
+The `audit_log` data stream provides administrative and workspace audit events from the OpenAI ChatGPT Enterprise Compliance Logs Platform.
+
+#### Audit Log fields
+
+{{ fields "audit_log" }}
+
+### Example event
+
+{{ event "audit_log" }}
+
+### Inputs used
+{{/* All inputs used by this package will be automatically listed here. */}}
+{{ inputDocs }}
+
+### API usage
+
+These APIs are used with this integration:
+
+* List compliance log files (endpoint: `GET /v1/compliance/workspaces/{workspace_id}/logs` or `GET /v1/compliance/organizations/{organization_id}/logs`)
+* Download a compliance log file (endpoint: `GET /v1/compliance/workspaces/{workspace_id}/logs/{log_file_id}` or `GET /v1/compliance/organizations/{organization_id}/logs/{log_file_id}`)
diff --git a/packages/openai_chatgpt_enterprise/_dev/deploy/docker/docker-compose.yml b/packages/openai_chatgpt_enterprise/_dev/deploy/docker/docker-compose.yml
new file mode 100644
index 00000000000..cee389e808b
--- /dev/null
+++ b/packages/openai_chatgpt_enterprise/_dev/deploy/docker/docker-compose.yml
@@ -0,0 +1,15 @@
+version: '3.8'
+services:
+ openai_chatgpt_enterprise:
+ image: docker.elastic.co/observability/stream:v0.22.0
+ hostname: openai_chatgpt_enterprise
+ ports:
+ - 8090
+ volumes:
+ - ./files:/files:ro
+ environment:
+ PORT: '8090'
+ command:
+ - http-server
+ - --addr=:8090
+ - --config=/files/config.yml
diff --git a/packages/openai_chatgpt_enterprise/_dev/deploy/docker/files/config.yml b/packages/openai_chatgpt_enterprise/_dev/deploy/docker/files/config.yml
new file mode 100644
index 00000000000..8d01c5fe9d0
--- /dev/null
+++ b/packages/openai_chatgpt_enterprise/_dev/deploy/docker/files/config.yml
@@ -0,0 +1,238 @@
+rules:
+ # --- PHASE 1: list log files — page 2 (requested with ?after=2026-07-09T12:00:00Z) ---
+ - path: /v1/compliance/workspaces/ws-example-001/logs
+ methods: ['GET']
+ query_params:
+ event_type: AUDIT_LOG
+ limit: 2
+ after: "2026-07-09T12:00:00Z"
+ request_headers:
+ Authorization:
+ - "Bearer xxxx"
+ responses:
+ - status_code: 200
+ headers:
+ Content-Type:
+ - 'application/json'
+ body: |-
+ {{ minify_json `
+ {
+ "data": [
+ {
+ "id": "eclf_a3000000000000000000000000000003",
+ "event_type": "AUDIT_LOG",
+ "end_time": "2026-07-09T13:00:00.000000Z",
+ "file_name": "AUDIT_LOG_2026-07-09T13:00:00.000000+00:00.jsonl",
+ "file_size": 2048,
+ "file_sha256": "c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3"
+ }
+ ],
+ "has_more": false,
+ "last_end_time": "2026-07-09T13:00:00Z"
+ }
+ `}}
+
+ # --- PHASE 1: list log files — page 1 (initial request) ---
+ - path: /v1/compliance/workspaces/ws-example-001/logs
+ methods: ['GET']
+ query_params:
+ event_type: AUDIT_LOG
+ limit: 2
+ request_headers:
+ Authorization:
+ - "Bearer xxxx"
+ responses:
+ - status_code: 200
+ headers:
+ Content-Type:
+ - 'application/json'
+ body: |-
+ {{ minify_json `
+ {
+ "data": [
+ {
+ "id": "eclf_a1000000000000000000000000000001",
+ "event_type": "AUDIT_LOG",
+ "end_time": "2026-07-09T11:30:00.000000Z",
+ "file_name": "AUDIT_LOG_2026-07-09T11:30:00.000000+00:00.jsonl",
+ "file_size": 1024,
+ "file_sha256": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1"
+ },
+ {
+ "id": "eclf_a2000000000000000000000000000002",
+ "event_type": "AUDIT_LOG",
+ "end_time": "2026-07-09T11:55:00.000000Z",
+ "file_name": "AUDIT_LOG_2026-07-09T11:55:00.000000+00:00.jsonl",
+ "file_size": 1536,
+ "file_sha256": "a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2"
+ }
+ ],
+ "has_more": true,
+ "last_end_time": "2026-07-09T12:00:00Z"
+ }
+ `}}
+
+ # --- PHASE 2: download log file eclf_a1 (JSON Lines body) ---
+ - path: /v1/compliance/workspaces/ws-example-001/logs/eclf_a1000000000000000000000000000001
+ methods: ['GET']
+ request_headers:
+ Authorization:
+ - "Bearer xxxx"
+ responses:
+ - status_code: 200
+ headers:
+ Content-Type:
+ - 'application/x-ndjson'
+ body: |-
+ {{ minify_json `
+ {
+ "event_id": "92b7dea7-9ff4-485e-b0a0-74efa627f15b",
+ "type": "AUDIT_LOG",
+ "principal": {"id": "be545252-ad04-4cfa-9ca5-deca58416151", "type": "CHATGPT_WORKSPACE"},
+ "actor": {"type": "API_KEY", "redacted_id": "sk-...RxIA"},
+ "timestamp": "2026-07-09T11:05:09.077133Z",
+ "action_result": "SUCCESS",
+ "action_privilege": "ADMIN",
+ "request_metadata": {
+ "client_ip": "81.2.69.142",
+ "client_ip_details": {"country": "GB", "city": "London", "region": "England", "region_code": "ENG", "asn": "", "latitude": "51.50853", "longitude": "-0.12574"},
+ "client_user_agent": "python-requests/2.34.2",
+ "client_ja3": "86dab2109182b6bbaa644647d7db2997",
+ "client_ja4": "t13d1713h1_ab0a1bf427ad_8537cf56674e",
+ "destination_hostname": "api.chatgpt.com"
+ },
+ "action_data": {"limit": "100", "after": "2026-07-09T10:24:53.814285Z", "event_type": "AUDIT_LOG"},
+ "action": "LIST_WORKSPACE_LOG_FILES"
+ }
+ `}}
+ {{ minify_json `
+ {
+ "event_id": "8b5e7eff-e114-475e-ad8b-8c443f55a1f2",
+ "type": "AUDIT_LOG",
+ "principal": {"id": "be545252-ad04-4cfa-9ca5-deca58416151", "type": "CHATGPT_WORKSPACE"},
+ "actor": {"type": "API_KEY", "redacted_id": "sk-...RxIA"},
+ "timestamp": "2026-07-09T11:05:09.292963Z",
+ "action_result": "SUCCESS",
+ "action_privilege": "ADMIN",
+ "request_metadata": {
+ "client_ip": "81.2.69.142",
+ "client_ip_details": {"country": "GB", "city": "London", "region": "England", "region_code": "ENG", "asn": "", "latitude": "51.50853", "longitude": "-0.12574"},
+ "client_user_agent": "python-requests/2.34.2",
+ "client_ja3": "86dab2109182b6bbaa644647d7db2997",
+ "client_ja4": "t13d1713h1_ab0a1bf427ad_8537cf56674e",
+ "destination_hostname": "api.chatgpt.com"
+ },
+ "action_data": {"log_file_id": "eclf_6a5cc4957340819181cb409f513e791c", "event_type": "AUDIT_LOG"},
+ "action": "DOWNLOAD_WORKSPACE_LOG_FILE"
+ }
+ `}}
+
+ # --- PHASE 2: download log file eclf_a2 (JSON Lines body) ---
+ - path: /v1/compliance/workspaces/ws-example-001/logs/eclf_a2000000000000000000000000000002
+ methods: ['GET']
+ request_headers:
+ Authorization:
+ - "Bearer xxxx"
+ responses:
+ - status_code: 200
+ headers:
+ Content-Type:
+ - 'application/x-ndjson'
+ body: |-
+ {{ minify_json `
+ {
+ "event_id": "344039bd-e40b-4020-8256-e44f7bbeeb3e",
+ "type": "AUDIT_LOG",
+ "principal": {"id": "be545252-ad04-4cfa-9ca5-deca58416151", "type": "CHATGPT_WORKSPACE"},
+ "actor": {"type": "ACCOUNT_USER", "user_id": "user-Aa11QwErTyUiOp", "user_email": "alice.martin@example.com"},
+ "timestamp": "2026-07-09T11:40:00.000000Z",
+ "action_result": "SUCCESS",
+ "action_privilege": "ADMIN",
+ "request_metadata": {
+ "client_ip": "89.160.20.112",
+ "client_ip_details": {"country": "SE", "city": "Linkoping", "region": "Ostergotland", "region_code": "E", "asn": "AS29518", "latitude": "58.4167", "longitude": "15.6167"},
+ "client_user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36",
+ "client_ja3": "",
+ "client_ja4": "",
+ "destination_hostname": null
+ },
+ "action_data": {"user_id": "user-Bb22AsDfGhJkLp", "new_role": "manager"},
+ "action": "USER_ROLE_UPDATED"
+ }
+ `}}
+ {{ minify_json `
+ {
+ "event_id": "b4ef3def-93af-43da-ac94-e7c79c34f4a1",
+ "type": "AUDIT_LOG",
+ "principal": {"id": "be545252-ad04-4cfa-9ca5-deca58416151", "type": "CHATGPT_WORKSPACE"},
+ "actor": {"type": "ACCOUNT_USER", "user_id": "user-Aa11QwErTyUiOp", "user_email": "alice.martin@example.com"},
+ "timestamp": "2026-07-09T11:45:00.000000Z",
+ "action_result": "SUCCESS",
+ "action_privilege": "ADMIN",
+ "request_metadata": {
+ "client_ip": "89.160.20.112",
+ "client_ip_details": {"country": "SE", "city": "Linkoping", "region": "Ostergotland", "region_code": "E", "asn": "AS29518", "latitude": "58.4167", "longitude": "15.6167"},
+ "client_user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36",
+ "client_ja3": "",
+ "client_ja4": "",
+ "destination_hostname": null
+ },
+ "action_data": {"app_id": "app-001", "app_name": "gdrive", "allowed_user_id": "user-Cc33ZxCvBnMkLo"},
+ "action": "APP_ALLOW_USER"
+ }
+ `}}
+
+ # --- PHASE 2: download log file eclf_a3 (JSON Lines body) ---
+ - path: /v1/compliance/workspaces/ws-example-001/logs/eclf_a3000000000000000000000000000003
+ methods: ['GET']
+ request_headers:
+ Authorization:
+ - "Bearer xxxx"
+ responses:
+ - status_code: 200
+ headers:
+ Content-Type:
+ - 'application/x-ndjson'
+ body: |-
+ {{ minify_json `
+ {
+ "event_id": "f7ce6f1c-2f08-4692-973e-3919427bde82",
+ "type": "AUDIT_LOG",
+ "principal": {"id": "be545252-ad04-4cfa-9ca5-deca58416151", "type": "CHATGPT_WORKSPACE"},
+ "actor": {"type": "ACCOUNT_USER", "user_id": "user-Aa11QwErTyUiOp", "user_email": "alice.martin@example.com"},
+ "timestamp": "2026-07-09T12:30:00.000000Z",
+ "action_result": "SUCCESS",
+ "action_privilege": "ADMIN",
+ "request_metadata": {
+ "client_ip": "81.2.69.142",
+ "client_ip_details": {"country": "GB", "city": "London", "region": "England", "region_code": "ENG", "asn": "", "latitude": "51.50853", "longitude": "-0.12574"},
+ "client_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Firefox/127.0",
+ "client_ja3": "",
+ "client_ja4": "",
+ "destination_hostname": null
+ },
+ "action_data": {"feature": "gpt_sharing", "value": true},
+ "action": "WORKSPACE_TOGGLE_FEATURE"
+ }
+ `}}
+ {{ minify_json `
+ {
+ "event_id": "b521d25e-0a2c-4b69-bfcc-70c0fdfadd03",
+ "type": "AUDIT_LOG",
+ "principal": {"id": "be545252-ad04-4cfa-9ca5-deca58416151", "type": "CHATGPT_WORKSPACE"},
+ "actor": {"type": "ACCOUNT_USER", "user_id": "user-Aa11QwErTyUiOp", "user_email": "alice.martin@example.com"},
+ "timestamp": "2026-07-09T12:50:00.000000Z",
+ "action_result": "SUCCESS",
+ "action_privilege": "ADMIN",
+ "request_metadata": {
+ "client_ip": "81.2.69.142",
+ "client_ip_details": {"country": "GB", "city": "London", "region": "England", "region_code": "ENG", "asn": "", "latitude": "51.50853", "longitude": "-0.12574"},
+ "client_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Firefox/127.0",
+ "client_ja3": "",
+ "client_ja4": "",
+ "destination_hostname": null
+ },
+ "action_data": {"email_addresses": ["new.hire@example.com"], "role": "user"},
+ "action": "INVITE_SEND"
+ }
+ `}}
diff --git a/packages/openai_chatgpt_enterprise/changelog.yml b/packages/openai_chatgpt_enterprise/changelog.yml
new file mode 100644
index 00000000000..687df09195f
--- /dev/null
+++ b/packages/openai_chatgpt_enterprise/changelog.yml
@@ -0,0 +1,6 @@
+# newer versions go on top
+- version: '0.1.0'
+ changes:
+ - description: Initial release of the OpenAI ChatGPT Enterprise Audit Logs (audit_log) data stream.
+ type: enhancement
+ link: https://github.com/elastic/integrations/pull/20210
diff --git a/packages/openai_chatgpt_enterprise/data_stream/audit_log/_dev/test/pipeline/test-audit-log.log b/packages/openai_chatgpt_enterprise/data_stream/audit_log/_dev/test/pipeline/test-audit-log.log
new file mode 100644
index 00000000000..651ef4c2458
--- /dev/null
+++ b/packages/openai_chatgpt_enterprise/data_stream/audit_log/_dev/test/pipeline/test-audit-log.log
@@ -0,0 +1,4 @@
+{"event_id":"92b7dea7-9ff4-485e-b0a0-74efa627f15b","type":"AUDIT_LOG","principal":{"id":"be545252-ad04-4cfa-9ca5-deca58416151","type":"CHATGPT_WORKSPACE"},"actor":{"type":"API_KEY","redacted_id":"sk-...RxIA"},"timestamp":"2026-07-09T11:05:09.077133Z","action_result":"SUCCESS","action_privilege":"ADMIN","request_metadata":{"client_ip":"81.2.69.142","client_ip_details":{"country":"GB","city":"London","region":"England","region_code":"ENG","asn":"","latitude":"51.50853","longitude":"-0.12574"},"client_user_agent":"python-requests/2.34.2","client_ja3":"86dab2109182b6bbaa644647d7db2997","client_ja4":"t13d1713h1_ab0a1bf427ad_8537cf56674e","destination_hostname":"api.chatgpt.com"},"action_data":{"limit":"100","after":"2026-07-09T10:24:53.814285Z","event_type":"AUDIT_LOG"},"action":"LIST_WORKSPACE_LOG_FILES"}
+{"event_id":"344039bd-e40b-4020-8256-e44f7bbeeb3e","type":"AUDIT_LOG","principal":{"id":"be545252-ad04-4cfa-9ca5-deca58416151","type":"CHATGPT_WORKSPACE"},"actor":{"type":"ACCOUNT_USER","user_id":"user-Aa11QwErTyUiOp","user_email":"alice.martin@example.com"},"timestamp":"2026-07-09T11:40:00.000000Z","action_result":"SUCCESS","action_privilege":"ADMIN","request_metadata":{"client_ip":"89.160.20.112","client_ip_details":{"country":"SE","city":"Linkoping","region":"Ostergotland","region_code":"E","asn":"AS29518","latitude":"58.4167","longitude":"15.6167"},"client_user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36","client_ja3":"","client_ja4":"","destination_hostname":null},"action_data":{"user_id":"user-Bb22AsDfGhJkLp","new_role":"manager"},"action":"USER_ROLE_UPDATED"}
+{"event_id":"f7ce6f1c-2f08-4692-973e-3919427bde82","type":"AUDIT_LOG","principal":{"id":"be545252-ad04-4cfa-9ca5-deca58416151","type":"CHATGPT_WORKSPACE"},"actor":{"type":"ACCOUNT_USER","user_id":"user-Aa11QwErTyUiOp","user_email":"alice.martin@example.com"},"timestamp":"2026-07-09T12:30:00.000000Z","action_result":"SUCCESS","action_privilege":"ADMIN","request_metadata":{"client_ip":"81.2.69.142","client_ip_details":{"country":"GB","city":"London","region":"England","region_code":"ENG","asn":"","latitude":"51.50853","longitude":"-0.12574"},"client_user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) Firefox/127.0","client_ja3":"","client_ja4":"","destination_hostname":null},"action_data":{"feature":"gpt_sharing","value":true},"action":"WORKSPACE_TOGGLE_FEATURE"}
+{"event_id":"b521d25e-0a2c-4b69-bfcc-70c0fdfadd03","type":"AUDIT_LOG","principal":{"id":"be545252-ad04-4cfa-9ca5-deca58416151","type":"CHATGPT_WORKSPACE"},"actor":{"type":"ACCOUNT_USER","user_id":"user-Aa11QwErTyUiOp","user_email":"alice.martin@example.com"},"timestamp":"2026-07-09T12:50:00.000000Z","action_result":"BLOCKED","action_privilege":"ADMIN","request_metadata":{"client_ip":"81.2.69.142","client_ip_details":{"country":"GB","city":"London","region":"England","region_code":"ENG","asn":"","latitude":"51.50853","longitude":"-0.12574"},"client_user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) Firefox/127.0","client_ja3":"","client_ja4":"","destination_hostname":null},"action_data":{"email_addresses":["new.hire@example.com"],"role":"user"},"action":"INVITE_SEND"}
diff --git a/packages/openai_chatgpt_enterprise/data_stream/audit_log/_dev/test/pipeline/test-audit-log.log-expected.json b/packages/openai_chatgpt_enterprise/data_stream/audit_log/_dev/test/pipeline/test-audit-log.log-expected.json
new file mode 100644
index 00000000000..559951456d3
--- /dev/null
+++ b/packages/openai_chatgpt_enterprise/data_stream/audit_log/_dev/test/pipeline/test-audit-log.log-expected.json
@@ -0,0 +1,390 @@
+{
+ "expected": [
+ {
+ "@timestamp": "2026-07-09T11:05:09.077Z",
+ "destination": {
+ "domain": "api.chatgpt.com"
+ },
+ "ecs": {
+ "version": "9.4.0"
+ },
+ "event": {
+ "action": "list_workspace_log_files",
+ "category": [
+ "iam"
+ ],
+ "id": "92b7dea7-9ff4-485e-b0a0-74efa627f15b",
+ "kind": "event",
+ "original": "{\"event_id\":\"92b7dea7-9ff4-485e-b0a0-74efa627f15b\",\"type\":\"AUDIT_LOG\",\"principal\":{\"id\":\"be545252-ad04-4cfa-9ca5-deca58416151\",\"type\":\"CHATGPT_WORKSPACE\"},\"actor\":{\"type\":\"API_KEY\",\"redacted_id\":\"sk-...RxIA\"},\"timestamp\":\"2026-07-09T11:05:09.077133Z\",\"action_result\":\"SUCCESS\",\"action_privilege\":\"ADMIN\",\"request_metadata\":{\"client_ip\":\"81.2.69.142\",\"client_ip_details\":{\"country\":\"GB\",\"city\":\"London\",\"region\":\"England\",\"region_code\":\"ENG\",\"asn\":\"\",\"latitude\":\"51.50853\",\"longitude\":\"-0.12574\"},\"client_user_agent\":\"python-requests/2.34.2\",\"client_ja3\":\"86dab2109182b6bbaa644647d7db2997\",\"client_ja4\":\"t13d1713h1_ab0a1bf427ad_8537cf56674e\",\"destination_hostname\":\"api.chatgpt.com\"},\"action_data\":{\"limit\":\"100\",\"after\":\"2026-07-09T10:24:53.814285Z\",\"event_type\":\"AUDIT_LOG\"},\"action\":\"LIST_WORKSPACE_LOG_FILES\"}",
+ "outcome": "success",
+ "type": [
+ "info"
+ ]
+ },
+ "gen_ai": {
+ "system": "openai"
+ },
+ "openai_chatgpt_enterprise": {
+ "audit_log": {
+ "action_data": {
+ "after": "2026-07-09T10:24:53.814Z",
+ "event_type": "AUDIT_LOG",
+ "limit": 100
+ },
+ "action_privilege": "ADMIN",
+ "action_result": "SUCCESS",
+ "actor": {
+ "redacted_id": "sk-...RxIA",
+ "type": "API_KEY"
+ },
+ "principal": {
+ "type": "CHATGPT_WORKSPACE"
+ },
+ "request_metadata": {
+ "client_ip_details": {
+ "city": "London",
+ "country": "GB",
+ "latitude": "51.50853",
+ "longitude": "-0.12574",
+ "region": "England",
+ "region_code": "ENG"
+ },
+ "client_ja4": "t13d1713h1_ab0a1bf427ad_8537cf56674e"
+ },
+ "type": "AUDIT_LOG"
+ }
+ },
+ "organization": {
+ "id": "be545252-ad04-4cfa-9ca5-deca58416151"
+ },
+ "related": {
+ "ip": [
+ "81.2.69.142"
+ ]
+ },
+ "source": {
+ "geo": {
+ "city_name": "London",
+ "continent_name": "Europe",
+ "country_iso_code": "GB",
+ "country_name": "United Kingdom",
+ "location": {
+ "lat": 51.5142,
+ "lon": -0.0931
+ },
+ "region_iso_code": "GB-ENG",
+ "region_name": "England"
+ },
+ "ip": "81.2.69.142"
+ },
+ "tls": {
+ "client": {
+ "ja3": "86dab2109182b6bbaa644647d7db2997"
+ }
+ },
+ "user_agent": {
+ "device": {
+ "name": "Other"
+ },
+ "name": "Python Requests",
+ "original": "python-requests/2.34.2",
+ "version": "2.34"
+ }
+ },
+ {
+ "@timestamp": "2026-07-09T11:40:00.000Z",
+ "ecs": {
+ "version": "9.4.0"
+ },
+ "event": {
+ "action": "user_role_updated",
+ "category": [
+ "iam"
+ ],
+ "id": "344039bd-e40b-4020-8256-e44f7bbeeb3e",
+ "kind": "event",
+ "original": "{\"event_id\":\"344039bd-e40b-4020-8256-e44f7bbeeb3e\",\"type\":\"AUDIT_LOG\",\"principal\":{\"id\":\"be545252-ad04-4cfa-9ca5-deca58416151\",\"type\":\"CHATGPT_WORKSPACE\"},\"actor\":{\"type\":\"ACCOUNT_USER\",\"user_id\":\"user-Aa11QwErTyUiOp\",\"user_email\":\"alice.martin@example.com\"},\"timestamp\":\"2026-07-09T11:40:00.000000Z\",\"action_result\":\"SUCCESS\",\"action_privilege\":\"ADMIN\",\"request_metadata\":{\"client_ip\":\"89.160.20.112\",\"client_ip_details\":{\"country\":\"SE\",\"city\":\"Linkoping\",\"region\":\"Ostergotland\",\"region_code\":\"E\",\"asn\":\"AS29518\",\"latitude\":\"58.4167\",\"longitude\":\"15.6167\"},\"client_user_agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36\",\"client_ja3\":\"\",\"client_ja4\":\"\",\"destination_hostname\":null},\"action_data\":{\"user_id\":\"user-Bb22AsDfGhJkLp\",\"new_role\":\"manager\"},\"action\":\"USER_ROLE_UPDATED\"}",
+ "outcome": "success",
+ "type": [
+ "info"
+ ]
+ },
+ "gen_ai": {
+ "system": "openai"
+ },
+ "openai_chatgpt_enterprise": {
+ "audit_log": {
+ "action_data": {
+ "new_role": "manager",
+ "user_id": "user-Bb22AsDfGhJkLp"
+ },
+ "action_privilege": "ADMIN",
+ "action_result": "SUCCESS",
+ "actor": {
+ "type": "ACCOUNT_USER"
+ },
+ "principal": {
+ "type": "CHATGPT_WORKSPACE"
+ },
+ "request_metadata": {
+ "client_ip_details": {
+ "asn": "AS29518",
+ "city": "Linkoping",
+ "country": "SE",
+ "latitude": "58.4167",
+ "longitude": "15.6167",
+ "region": "Ostergotland",
+ "region_code": "E"
+ }
+ },
+ "type": "AUDIT_LOG"
+ }
+ },
+ "organization": {
+ "id": "be545252-ad04-4cfa-9ca5-deca58416151"
+ },
+ "related": {
+ "ip": [
+ "89.160.20.112"
+ ],
+ "user": [
+ "user-Bb22AsDfGhJkLp",
+ "alice.martin@example.com",
+ "user-Aa11QwErTyUiOp"
+ ]
+ },
+ "source": {
+ "as": {
+ "number": 29518,
+ "organization": {
+ "name": "Bredband2 AB"
+ }
+ },
+ "geo": {
+ "city_name": "Linköping",
+ "continent_name": "Europe",
+ "country_iso_code": "SE",
+ "country_name": "Sweden",
+ "location": {
+ "lat": 58.4167,
+ "lon": 15.6167
+ },
+ "region_iso_code": "SE-E",
+ "region_name": "Östergötland County"
+ },
+ "ip": "89.160.20.112"
+ },
+ "user": {
+ "domain": "example.com",
+ "email": "alice.martin@example.com",
+ "id": "user-Aa11QwErTyUiOp",
+ "target": {
+ "id": "user-Bb22AsDfGhJkLp"
+ }
+ },
+ "user_agent": {
+ "device": {
+ "name": "Mac"
+ },
+ "name": "Other",
+ "original": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36",
+ "os": {
+ "full": "Mac OS X 10.15.7",
+ "name": "Mac OS X",
+ "version": "10.15.7"
+ }
+ }
+ },
+ {
+ "@timestamp": "2026-07-09T12:30:00.000Z",
+ "ecs": {
+ "version": "9.4.0"
+ },
+ "event": {
+ "action": "workspace_toggle_feature",
+ "category": [
+ "iam"
+ ],
+ "id": "f7ce6f1c-2f08-4692-973e-3919427bde82",
+ "kind": "event",
+ "original": "{\"event_id\":\"f7ce6f1c-2f08-4692-973e-3919427bde82\",\"type\":\"AUDIT_LOG\",\"principal\":{\"id\":\"be545252-ad04-4cfa-9ca5-deca58416151\",\"type\":\"CHATGPT_WORKSPACE\"},\"actor\":{\"type\":\"ACCOUNT_USER\",\"user_id\":\"user-Aa11QwErTyUiOp\",\"user_email\":\"alice.martin@example.com\"},\"timestamp\":\"2026-07-09T12:30:00.000000Z\",\"action_result\":\"SUCCESS\",\"action_privilege\":\"ADMIN\",\"request_metadata\":{\"client_ip\":\"81.2.69.142\",\"client_ip_details\":{\"country\":\"GB\",\"city\":\"London\",\"region\":\"England\",\"region_code\":\"ENG\",\"asn\":\"\",\"latitude\":\"51.50853\",\"longitude\":\"-0.12574\"},\"client_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) Firefox/127.0\",\"client_ja3\":\"\",\"client_ja4\":\"\",\"destination_hostname\":null},\"action_data\":{\"feature\":\"gpt_sharing\",\"value\":true},\"action\":\"WORKSPACE_TOGGLE_FEATURE\"}",
+ "outcome": "success",
+ "type": [
+ "info"
+ ]
+ },
+ "gen_ai": {
+ "system": "openai"
+ },
+ "openai_chatgpt_enterprise": {
+ "audit_log": {
+ "action_data": {
+ "feature": "gpt_sharing",
+ "value_bool": true
+ },
+ "action_privilege": "ADMIN",
+ "action_result": "SUCCESS",
+ "actor": {
+ "type": "ACCOUNT_USER"
+ },
+ "principal": {
+ "type": "CHATGPT_WORKSPACE"
+ },
+ "request_metadata": {
+ "client_ip_details": {
+ "city": "London",
+ "country": "GB",
+ "latitude": "51.50853",
+ "longitude": "-0.12574",
+ "region": "England",
+ "region_code": "ENG"
+ }
+ },
+ "type": "AUDIT_LOG"
+ }
+ },
+ "organization": {
+ "id": "be545252-ad04-4cfa-9ca5-deca58416151"
+ },
+ "related": {
+ "ip": [
+ "81.2.69.142"
+ ],
+ "user": [
+ "alice.martin@example.com",
+ "user-Aa11QwErTyUiOp"
+ ]
+ },
+ "source": {
+ "geo": {
+ "city_name": "London",
+ "continent_name": "Europe",
+ "country_iso_code": "GB",
+ "country_name": "United Kingdom",
+ "location": {
+ "lat": 51.5142,
+ "lon": -0.0931
+ },
+ "region_iso_code": "GB-ENG",
+ "region_name": "England"
+ },
+ "ip": "81.2.69.142"
+ },
+ "user": {
+ "domain": "example.com",
+ "email": "alice.martin@example.com",
+ "id": "user-Aa11QwErTyUiOp"
+ },
+ "user_agent": {
+ "device": {
+ "name": "Other"
+ },
+ "name": "Firefox",
+ "original": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Firefox/127.0",
+ "os": {
+ "full": "Windows 10",
+ "name": "Windows",
+ "version": "10"
+ },
+ "version": "127.0"
+ }
+ },
+ {
+ "@timestamp": "2026-07-09T12:50:00.000Z",
+ "ecs": {
+ "version": "9.4.0"
+ },
+ "event": {
+ "action": "invite_send",
+ "category": [
+ "iam"
+ ],
+ "id": "b521d25e-0a2c-4b69-bfcc-70c0fdfadd03",
+ "kind": "event",
+ "original": "{\"event_id\":\"b521d25e-0a2c-4b69-bfcc-70c0fdfadd03\",\"type\":\"AUDIT_LOG\",\"principal\":{\"id\":\"be545252-ad04-4cfa-9ca5-deca58416151\",\"type\":\"CHATGPT_WORKSPACE\"},\"actor\":{\"type\":\"ACCOUNT_USER\",\"user_id\":\"user-Aa11QwErTyUiOp\",\"user_email\":\"alice.martin@example.com\"},\"timestamp\":\"2026-07-09T12:50:00.000000Z\",\"action_result\":\"BLOCKED\",\"action_privilege\":\"ADMIN\",\"request_metadata\":{\"client_ip\":\"81.2.69.142\",\"client_ip_details\":{\"country\":\"GB\",\"city\":\"London\",\"region\":\"England\",\"region_code\":\"ENG\",\"asn\":\"\",\"latitude\":\"51.50853\",\"longitude\":\"-0.12574\"},\"client_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) Firefox/127.0\",\"client_ja3\":\"\",\"client_ja4\":\"\",\"destination_hostname\":null},\"action_data\":{\"email_addresses\":[\"new.hire@example.com\"],\"role\":\"user\"},\"action\":\"INVITE_SEND\"}",
+ "outcome": "failure",
+ "type": [
+ "info"
+ ]
+ },
+ "gen_ai": {
+ "system": "openai"
+ },
+ "openai_chatgpt_enterprise": {
+ "audit_log": {
+ "action_data": {
+ "email_addresses": [
+ "new.hire@example.com"
+ ],
+ "role": "user"
+ },
+ "action_privilege": "ADMIN",
+ "action_result": "BLOCKED",
+ "actor": {
+ "type": "ACCOUNT_USER"
+ },
+ "principal": {
+ "type": "CHATGPT_WORKSPACE"
+ },
+ "request_metadata": {
+ "client_ip_details": {
+ "city": "London",
+ "country": "GB",
+ "latitude": "51.50853",
+ "longitude": "-0.12574",
+ "region": "England",
+ "region_code": "ENG"
+ }
+ },
+ "type": "AUDIT_LOG"
+ }
+ },
+ "organization": {
+ "id": "be545252-ad04-4cfa-9ca5-deca58416151"
+ },
+ "related": {
+ "ip": [
+ "81.2.69.142"
+ ],
+ "user": [
+ "new.hire@example.com",
+ "alice.martin@example.com",
+ "user-Aa11QwErTyUiOp"
+ ]
+ },
+ "source": {
+ "geo": {
+ "city_name": "London",
+ "continent_name": "Europe",
+ "country_iso_code": "GB",
+ "country_name": "United Kingdom",
+ "location": {
+ "lat": 51.5142,
+ "lon": -0.0931
+ },
+ "region_iso_code": "GB-ENG",
+ "region_name": "England"
+ },
+ "ip": "81.2.69.142"
+ },
+ "user": {
+ "domain": "example.com",
+ "email": "alice.martin@example.com",
+ "id": "user-Aa11QwErTyUiOp"
+ },
+ "user_agent": {
+ "device": {
+ "name": "Other"
+ },
+ "name": "Firefox",
+ "original": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Firefox/127.0",
+ "os": {
+ "full": "Windows 10",
+ "name": "Windows",
+ "version": "10"
+ },
+ "version": "127.0"
+ }
+ }
+ ]
+}
diff --git a/packages/openai_chatgpt_enterprise/data_stream/audit_log/_dev/test/system/test-default-config.yml b/packages/openai_chatgpt_enterprise/data_stream/audit_log/_dev/test/system/test-default-config.yml
new file mode 100644
index 00000000000..dd7a5a612d9
--- /dev/null
+++ b/packages/openai_chatgpt_enterprise/data_stream/audit_log/_dev/test/system/test-default-config.yml
@@ -0,0 +1,16 @@
+wait_for_data_timeout: 1m
+input: cel
+service: openai_chatgpt_enterprise
+vars:
+ url: http://{{Hostname}}:{{Port}}
+ admin_token: xxxx
+data_stream:
+ vars:
+ scope: workspace
+ resource_id: ws-example-001
+ interval: 2s
+ batch_size: 2
+ initial_interval: 24h
+ preserve_original_event: true
+assert:
+ hit_count: 6
diff --git a/packages/openai_chatgpt_enterprise/data_stream/audit_log/agent/stream/cel.yml.hbs b/packages/openai_chatgpt_enterprise/data_stream/audit_log/agent/stream/cel.yml.hbs
new file mode 100644
index 00000000000..9bf8afefbc8
--- /dev/null
+++ b/packages/openai_chatgpt_enterprise/data_stream/audit_log/agent/stream/cel.yml.hbs
@@ -0,0 +1,155 @@
+interval: {{interval}}
+resource.tracer:
+ enabled: {{enable_request_tracer}}
+ filename: "../../logs/cel/http-request-trace-*.ndjson"
+ maxbackups: 5
+{{#if proxy_url}}
+resource.proxy_url: {{proxy_url}}
+{{/if}}
+{{#if ssl}}
+resource.ssl: {{ssl}}
+{{/if}}
+{{#if http_client_timeout}}
+resource.timeout: {{http_client_timeout}}
+{{/if}}
+resource.url: {{url}}
+state:
+ admin_token: {{admin_token}}
+ scope: {{scope}}
+ resource_id: {{resource_id}}
+ initial_interval: {{initial_interval}}
+ batch_size: {{batch_size}}
+redact:
+ fields:
+ - admin_token
+program: |-
+ (
+ // PHASE 1 — list files (only when the worklist is empty). This is the only
+ // paginated call: it pages forward with `after` = last_end_time (ascending).
+ (has(state.worklist) && size(state.worklist) > 0) ?
+ state
+ :
+ state.?cursor.last_end_time.orValue(string(now - duration(state.initial_interval))).as(after,
+ state.with(
+ request(
+ "GET",
+ state.url.trim_right("/") + "/v1/compliance/" + ((state.scope == "organization") ? "organizations" : "workspaces") + "/" + string(state.resource_id) + "/logs?" + {
+ "event_type": ["AUDIT_LOG"],
+ "after": [after],
+ "limit": [string(int(state.batch_size))],
+ }.format_query()
+ ).with(
+ {
+ "Header": {
+ "Authorization": ["Bearer " + state.admin_token],
+ },
+ }
+ ).do_request().as(resp, (resp.StatusCode == 200) ?
+ bytes(resp.Body).decode_json().as(body,
+ {
+ "worklist": body.?data.orValue([]),
+ "cursor": {
+ // Empty pages return last_end_time: null; keep the current
+ // `after` in that case so the cursor never becomes null.
+ "last_end_time": (has(body.last_end_time) && body.last_end_time != null) ?
+ body.last_end_time
+ :
+ after,
+ },
+ // Termination is driven by has_more, not by an empty page: this
+ // API re-returns the boundary record when re-queried with the same
+ // `after`, so an empty response is never observed on has_more=false.
+ "list_has_more": body.?has_more.orValue(false),
+ "want_more": size(body.?data.orValue([])) > 0,
+ }
+ )
+ :
+ {
+ "events": {
+ "error": {
+ "code": string(resp.StatusCode),
+ "id": resp.Status,
+ "message": "GET " + state.url.trim_right("/") + "/v1/compliance/logs: " + (
+ (size(resp.Body) != 0) ?
+ string(resp.Body)
+ :
+ resp.Status + " (" + string(resp.StatusCode) + ")"
+ ),
+ },
+ },
+ "want_more": false,
+ }
+ )
+ )
+ )
+ ).as(state,
+ // PHASE 2 — download the first queued file, then drop it from the worklist.
+ // This endpoint 307-redirects to a signed URL serving the JSON Lines body
+ // (redirect auto-followed). It has no pagination of its own.
+ !has(state.worklist) ?
+ state
+ : (size(state.worklist) > 0) ?
+ state.with(
+ request(
+ "GET",
+ state.url.trim_right("/") + "/v1/compliance/" + ((state.scope == "organization") ? "organizations" : "workspaces") + "/" + string(state.resource_id) + "/logs/" + string(state.worklist[0].id)
+ ).with(
+ {
+ "Header": {
+ "Authorization": ["Bearer " + state.admin_token],
+ },
+ }
+ ).do_request().as(resp, (resp.StatusCode == 200) ?
+ {
+ "events": string(resp.Body).split("\n").map(l, l.trim(" \r\n\t")).filter(l, l != "").map(l,
+ {
+ "message": l,
+ }
+ ),
+ "worklist": tail(state.worklist),
+ // Keep going while files remain in this page, or the list reported
+ // more pages. Stops right after the last file of the last page.
+ "want_more": size(state.worklist) > 1 || state.?list_has_more.orValue(false),
+ }
+ :
+ {
+ "events": {
+ "error": {
+ "code": string(resp.StatusCode),
+ "id": resp.Status,
+ "message": "GET " + state.url.trim_right("/") + "/v1/compliance/logs/" + string(state.worklist[0].id) + ": " + (
+ (size(resp.Body) != 0) ?
+ string(resp.Body)
+ :
+ resp.Status + " (" + string(resp.StatusCode) + ")"
+ ),
+ },
+ },
+ "worklist": tail(state.worklist),
+ "want_more": size(state.worklist) > 1 || state.?list_has_more.orValue(false),
+ }
+ )
+ )
+ :
+ state.with(
+ {
+ "events": [],
+ "want_more": false,
+ }
+ )
+ )
+
+tags:
+{{#if preserve_original_event}}
+ - preserve_original_event
+{{/if}}
+{{#each tags as |tag|}}
+ - {{tag}}
+{{/each}}
+{{#contains "forwarded" tags}}
+publisher_pipeline.disable_host: true
+{{/contains}}
+{{#if processors}}
+processors:
+{{processors}}
+{{/if}}
diff --git a/packages/openai_chatgpt_enterprise/data_stream/audit_log/elasticsearch/ingest_pipeline/default.yml b/packages/openai_chatgpt_enterprise/data_stream/audit_log/elasticsearch/ingest_pipeline/default.yml
new file mode 100644
index 00000000000..368ff2f0e1e
--- /dev/null
+++ b/packages/openai_chatgpt_enterprise/data_stream/audit_log/elasticsearch/ingest_pipeline/default.yml
@@ -0,0 +1,639 @@
+---
+description: Parse OpenAI ChatGPT Enterprise Audit Logs events.
+processors:
+ - set:
+ field: ecs.version
+ tag: set_ecs_version
+ value: '9.4.0'
+ - remove:
+ field:
+ - organization
+ - division
+ - team
+ ignore_missing: true
+ if: ctx.organization instanceof String && ctx.division instanceof String && ctx.team instanceof String
+ tag: remove_agentless_tags
+ description: >-
+ Removes the fields added by Agentless as metadata,
+ as they can collide with ECS fields.
+ - terminate:
+ tag: data_collection_error
+ if: ctx.error?.message != null && ctx.message == null && ctx.event?.original == null
+ description: error message set and no data to process.
+ - rename:
+ field: message
+ tag: rename_message_to_event_original
+ target_field: event.original
+ ignore_missing: true
+ description: >-
+ Renames the original `message` field to `event.original` to store a copy of the original message.
+ if: ctx.event?.original == null
+ - remove:
+ field: message
+ tag: remove_message
+ ignore_missing: true
+ description: The `message` field is no longer required if the document has an `event.original` field.
+ if: ctx.event?.original != null
+ - json:
+ field: event.original
+ target_field: openai_chatgpt_enterprise.audit_log
+ tag: parse_json
+ if: ctx.event?.original != null
+ - fingerprint:
+ fields:
+ - openai_chatgpt_enterprise.audit_log.event_id
+ target_field: _id
+ ignore_missing: true
+ tag: fingerprint_event_id
+ - set:
+ field: gen_ai.system
+ tag: set_gen_ai_system
+ value: openai
+ - set:
+ field: event.id
+ tag: set_event_id
+ copy_from: openai_chatgpt_enterprise.audit_log.event_id
+ ignore_empty_value: true
+ - date:
+ field: openai_chatgpt_enterprise.audit_log.timestamp
+ target_field: openai_chatgpt_enterprise.audit_log.timestamp
+ formats:
+ - ISO8601
+ tag: date_timestamp
+ if: ctx.openai_chatgpt_enterprise?.audit_log?.timestamp != null && ctx.openai_chatgpt_enterprise.audit_log.timestamp != ''
+ on_failure:
+ - remove:
+ field: openai_chatgpt_enterprise.audit_log.timestamp
+ ignore_missing: true
+ tag: remove_timestamp_on_failure
+ - append:
+ field: error.message
+ value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}'
+ - set:
+ field: '@timestamp'
+ tag: set_@timestamp_from_timestamp
+ copy_from: openai_chatgpt_enterprise.audit_log.timestamp
+ ignore_empty_value: true
+ - set:
+ field: event.kind
+ tag: set_event_kind
+ value: event
+ - set:
+ field: user.id
+ tag: set_user_id_from_actor
+ copy_from: openai_chatgpt_enterprise.audit_log.actor.user_id
+ ignore_empty_value: true
+ - set:
+ field: user.email
+ tag: set_user_email_from_actor
+ copy_from: openai_chatgpt_enterprise.audit_log.actor.user_email
+ ignore_empty_value: true
+ - dissect:
+ field: user.email
+ pattern: '%{}@%{user.domain}'
+ tag: dissect_user_domain_from_email
+ ignore_missing: true
+ if: ctx.user?.email != null && ctx.user.email.contains('@')
+ - set:
+ field: organization.id
+ tag: set_organization_id_from_principal
+ copy_from: openai_chatgpt_enterprise.audit_log.principal.id
+ ignore_empty_value: true
+ if: ctx.openai_chatgpt_enterprise?.audit_log?.principal?.id != null
+ - convert:
+ field: openai_chatgpt_enterprise.audit_log.request_metadata.client_ip
+ tag: convert_client_ip_to_ip
+ type: ip
+ ignore_missing: true
+ if: ctx.openai_chatgpt_enterprise?.audit_log?.request_metadata?.client_ip != ''
+ on_failure:
+ - remove:
+ field: openai_chatgpt_enterprise.audit_log.request_metadata.client_ip
+ ignore_missing: true
+ tag: remove_client_ip_on_failure
+ - append:
+ field: error.message
+ value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}'
+ - set:
+ field: source.ip
+ tag: set_source_ip_from_request_metadata
+ copy_from: openai_chatgpt_enterprise.audit_log.request_metadata.client_ip
+ ignore_empty_value: true
+ - set:
+ field: user_agent.original
+ tag: set_user_agent_original
+ copy_from: openai_chatgpt_enterprise.audit_log.request_metadata.client_user_agent
+ ignore_empty_value: true
+ - set:
+ field: event.action
+ tag: set_event_action
+ copy_from: openai_chatgpt_enterprise.audit_log.action
+ ignore_empty_value: true
+ - lowercase:
+ field: event.action
+ tag: lowercase_event_action
+ ignore_missing: true
+ - append:
+ field: event.category
+ tag: append_event_category_audit_log
+ value: iam
+ - append:
+ field: event.type
+ tag: append_event_type_audit_log
+ value: info
+ - set:
+ field: tls.client.ja3
+ tag: set_tls_client_ja3
+ copy_from: openai_chatgpt_enterprise.audit_log.request_metadata.client_ja3
+ ignore_empty_value: true
+ - set:
+ field: destination.domain
+ tag: set_destination_domain
+ copy_from: openai_chatgpt_enterprise.audit_log.request_metadata.destination_hostname
+ ignore_empty_value: true
+ - script:
+ lang: painless
+ tag: set_event_outcome_from_action_result
+ description: Normalize AUDIT_LOG action_result into event.outcome.
+ if: ctx.openai_chatgpt_enterprise?.audit_log?.action_result != null && ctx.openai_chatgpt_enterprise.audit_log.action_result != ''
+ source: |-
+ def r = ctx.openai_chatgpt_enterprise.audit_log.action_result;
+ if (r == 'SUCCESS') {
+ ctx.event.outcome = 'success';
+ } else if (r == 'ERROR' || r == 'BLOCKED') {
+ ctx.event.outcome = 'failure';
+ } else {
+ ctx.event.outcome = 'unknown';
+ }
+ - set:
+ field: user.target.id
+ tag: set_user_target_id_from_user_id
+ copy_from: openai_chatgpt_enterprise.audit_log.action_data.user_id
+ ignore_empty_value: true
+ - set:
+ field: user.target.id
+ tag: set_user_target_id_from_added_user_id
+ copy_from: openai_chatgpt_enterprise.audit_log.action_data.added_user_id
+ ignore_empty_value: true
+ if: ctx.user?.target?.id == null
+ - set:
+ field: user.target.id
+ tag: set_user_target_id_from_allowed_user_id
+ copy_from: openai_chatgpt_enterprise.audit_log.action_data.allowed_user_id
+ ignore_empty_value: true
+ if: ctx.user?.target?.id == null
+ - set:
+ field: user.target.id
+ tag: set_user_target_id_from_deleted_user_id
+ copy_from: openai_chatgpt_enterprise.audit_log.action_data.deleted_user_id
+ ignore_empty_value: true
+ if: ctx.user?.target?.id == null
+ - set:
+ field: user.target.id
+ tag: set_user_target_id_from_disallowed_user_id
+ copy_from: openai_chatgpt_enterprise.audit_log.action_data.disallowed_user_id
+ ignore_empty_value: true
+ if: ctx.user?.target?.id == null
+ - set:
+ field: user.target.id
+ tag: set_user_target_id_from_removed_user_id
+ copy_from: openai_chatgpt_enterprise.audit_log.action_data.removed_user_id
+ ignore_empty_value: true
+ if: ctx.user?.target?.id == null
+ - set:
+ field: user.target.id
+ tag: set_user_target_id_from_logged_out_user_id
+ copy_from: openai_chatgpt_enterprise.audit_log.action_data.logged_out_user_id
+ ignore_empty_value: true
+ if: ctx.user?.target?.id == null
+ - set:
+ field: user.target.email
+ tag: set_user_target_email_from_new_owner_email
+ copy_from: openai_chatgpt_enterprise.audit_log.action_data.new_owner_email
+ ignore_empty_value: true
+ - set:
+ field: file.name
+ tag: set_file_name_from_action_data
+ copy_from: openai_chatgpt_enterprise.audit_log.action_data.file_name
+ ignore_empty_value: true
+ - set:
+ field: file.mime_type
+ tag: set_file_mime_type_from_action_data
+ copy_from: openai_chatgpt_enterprise.audit_log.action_data.mime_type
+ ignore_empty_value: true
+ - append:
+ field: related.user
+ tag: append_user_target_id_to_related
+ value: '{{{user.target.id}}}'
+ allow_duplicates: false
+ if: ctx.user?.target?.id != null
+ - append:
+ field: related.user
+ tag: append_user_target_email_to_related
+ value: '{{{user.target.email}}}'
+ allow_duplicates: false
+ if: ctx.user?.target?.email != null
+ - append:
+ field: related.user
+ tag: append_action_data_email_address_to_related
+ value: '{{{openai_chatgpt_enterprise.audit_log.action_data.email_address}}}'
+ allow_duplicates: false
+ if: ctx.openai_chatgpt_enterprise?.audit_log?.action_data?.email_address != null && ctx.openai_chatgpt_enterprise.audit_log.action_data.email_address != ''
+ - foreach:
+ field: openai_chatgpt_enterprise.audit_log.action_data.email_addresses
+ ignore_missing: true
+ tag: foreach_append_email_addresses_to_related
+ if: ctx.openai_chatgpt_enterprise?.audit_log?.action_data?.email_addresses instanceof List
+ processor:
+ append:
+ field: related.user
+ value: '{{{_ingest._value}}}'
+ allow_duplicates: false
+ - rename:
+ field: openai_chatgpt_enterprise.audit_log.action_data.value
+ target_field: openai_chatgpt_enterprise.audit_log.action_data.value_bool
+ ignore_missing: true
+ tag: rename_action_data_value_to_value_bool
+ - convert:
+ field: openai_chatgpt_enterprise.audit_log.action_data.value_bool
+ type: boolean
+ ignore_missing: true
+ tag: convert_action_data_value_bool
+ on_failure:
+ - rename:
+ field: openai_chatgpt_enterprise.audit_log.action_data.value_bool
+ target_field: openai_chatgpt_enterprise.audit_log.action_data.value
+ ignore_missing: true
+ tag: rename_action_data_value_bool_to_value
+ - date:
+ field: openai_chatgpt_enterprise.audit_log.action_data.after
+ target_field: openai_chatgpt_enterprise.audit_log.action_data.after
+ formats:
+ - ISO8601
+ tag: date_action_data_after
+ if: ctx.openai_chatgpt_enterprise?.audit_log?.action_data?.after != null && ctx.openai_chatgpt_enterprise.audit_log.action_data.after != ''
+ on_failure:
+ - rename:
+ field: openai_chatgpt_enterprise.audit_log.action_data.after
+ target_field: openai_chatgpt_enterprise.audit_log.action_data.after_string
+ ignore_missing: true
+ tag: rename_action_data_after_on_failure
+ - date:
+ field: openai_chatgpt_enterprise.audit_log.action_data.before
+ target_field: openai_chatgpt_enterprise.audit_log.action_data.before
+ formats:
+ - ISO8601
+ tag: date_action_data_before
+ if: ctx.openai_chatgpt_enterprise?.audit_log?.action_data?.before != null && ctx.openai_chatgpt_enterprise.audit_log.action_data.before != ''
+ on_failure:
+ - rename:
+ field: openai_chatgpt_enterprise.audit_log.action_data.before
+ target_field: openai_chatgpt_enterprise.audit_log.action_data.before_string
+ ignore_missing: true
+ tag: rename_action_data_before_on_failure
+ - date:
+ field: openai_chatgpt_enterprise.audit_log.action_data.since_timestamp
+ target_field: openai_chatgpt_enterprise.audit_log.action_data.since_timestamp
+ formats:
+ - ISO8601
+ tag: date_action_data_since_timestamp
+ if: ctx.openai_chatgpt_enterprise?.audit_log?.action_data?.since_timestamp != null && ctx.openai_chatgpt_enterprise.audit_log.action_data.since_timestamp != ''
+ on_failure:
+ - remove:
+ field: openai_chatgpt_enterprise.audit_log.action_data.since_timestamp
+ ignore_missing: true
+ tag: remove_action_data_since_timestamp_on_failure
+ - append:
+ field: error.message
+ value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}'
+ - date:
+ field: openai_chatgpt_enterprise.audit_log.action_data.created_at
+ target_field: openai_chatgpt_enterprise.audit_log.action_data.created_at
+ formats:
+ - UNIX
+ tag: date_action_data_created_at
+ if: ctx.openai_chatgpt_enterprise?.audit_log?.action_data?.created_at != null && ctx.openai_chatgpt_enterprise.audit_log.action_data.created_at != ''
+ on_failure:
+ - remove:
+ field: openai_chatgpt_enterprise.audit_log.action_data.created_at
+ ignore_missing: true
+ tag: remove_action_data_created_at_on_failure
+ - append:
+ field: error.message
+ value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}'
+ - date:
+ field: openai_chatgpt_enterprise.audit_log.action_data.deactivated_at
+ target_field: openai_chatgpt_enterprise.audit_log.action_data.deactivated_at
+ formats:
+ - UNIX
+ tag: date_action_data_deactivated_at
+ if: ctx.openai_chatgpt_enterprise?.audit_log?.action_data?.deactivated_at != null && ctx.openai_chatgpt_enterprise.audit_log.action_data.deactivated_at != ''
+ on_failure:
+ - remove:
+ field: openai_chatgpt_enterprise.audit_log.action_data.deactivated_at
+ ignore_missing: true
+ tag: remove_action_data_deactivated_at_on_failure
+ - append:
+ field: error.message
+ value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}'
+ - date:
+ field: openai_chatgpt_enterprise.audit_log.action_data.expires_at
+ target_field: openai_chatgpt_enterprise.audit_log.action_data.expires_at
+ formats:
+ - UNIX
+ tag: date_action_data_expires_at
+ if: ctx.openai_chatgpt_enterprise?.audit_log?.action_data?.expires_at != null && ctx.openai_chatgpt_enterprise.audit_log.action_data.expires_at != ''
+ on_failure:
+ - remove:
+ field: openai_chatgpt_enterprise.audit_log.action_data.expires_at
+ ignore_missing: true
+ tag: remove_action_data_expires_at_on_failure
+ - append:
+ field: error.message
+ value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}'
+ - date:
+ field: openai_chatgpt_enterprise.audit_log.action_data.revoked_at
+ target_field: openai_chatgpt_enterprise.audit_log.action_data.revoked_at
+ formats:
+ - UNIX
+ tag: date_action_data_revoked_at
+ if: ctx.openai_chatgpt_enterprise?.audit_log?.action_data?.revoked_at != null && ctx.openai_chatgpt_enterprise.audit_log.action_data.revoked_at != ''
+ on_failure:
+ - remove:
+ field: openai_chatgpt_enterprise.audit_log.action_data.revoked_at
+ ignore_missing: true
+ tag: remove_action_data_revoked_at_on_failure
+ - append:
+ field: error.message
+ value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}'
+ - foreach:
+ field: openai_chatgpt_enterprise.audit_log.action_data.alert_thresholds
+ ignore_missing: true
+ tag: foreach_convert_action_data_alert_thresholds_credits
+ if: ctx.openai_chatgpt_enterprise?.audit_log?.action_data?.alert_thresholds instanceof List
+ processor:
+ convert:
+ field: _ingest._value.credits
+ type: long
+ ignore_missing: true
+ tag: convert_action_data_alert_thresholds_credits
+ on_failure:
+ - remove:
+ field: _ingest._value.credits
+ ignore_missing: true
+ tag: remove_action_data_alert_thresholds_credits_on_failure
+ - append:
+ field: error.message
+ value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}'
+ - convert:
+ field: openai_chatgpt_enterprise.audit_log.action_data.limit
+ type: long
+ ignore_missing: true
+ tag: convert_action_data_limit
+ if: ctx.openai_chatgpt_enterprise?.audit_log?.action_data?.limit != ''
+ on_failure:
+ - remove:
+ field: openai_chatgpt_enterprise.audit_log.action_data.limit
+ ignore_missing: true
+ tag: remove_action_data_limit_on_failure
+ - append:
+ field: error.message
+ value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}'
+ - convert:
+ field: openai_chatgpt_enterprise.audit_log.action_data.total_requested
+ type: long
+ ignore_missing: true
+ tag: convert_action_data_total_requested
+ if: ctx.openai_chatgpt_enterprise?.audit_log?.action_data?.total_requested != ''
+ on_failure:
+ - remove:
+ field: openai_chatgpt_enterprise.audit_log.action_data.total_requested
+ ignore_missing: true
+ tag: remove_action_data_total_requested_on_failure
+ - append:
+ field: error.message
+ value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}'
+ - convert:
+ field: openai_chatgpt_enterprise.audit_log.action_data.allow_all_in_workspace
+ type: boolean
+ ignore_missing: true
+ tag: convert_action_data_allow_all_in_workspace
+ if: ctx.openai_chatgpt_enterprise?.audit_log?.action_data?.allow_all_in_workspace != ''
+ on_failure:
+ - remove:
+ field: openai_chatgpt_enterprise.audit_log.action_data.allow_all_in_workspace
+ ignore_missing: true
+ tag: remove_action_data_allow_all_in_workspace_on_failure
+ - append:
+ field: error.message
+ value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}'
+ - convert:
+ field: openai_chatgpt_enterprise.audit_log.action_data.already_exists
+ type: boolean
+ ignore_missing: true
+ tag: convert_action_data_already_exists
+ if: ctx.openai_chatgpt_enterprise?.audit_log?.action_data?.already_exists != ''
+ on_failure:
+ - remove:
+ field: openai_chatgpt_enterprise.audit_log.action_data.already_exists
+ ignore_missing: true
+ tag: remove_action_data_already_exists_on_failure
+ - append:
+ field: error.message
+ value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}'
+ - convert:
+ field: openai_chatgpt_enterprise.audit_log.action_data.enabled
+ type: boolean
+ ignore_missing: true
+ tag: convert_action_data_enabled
+ if: ctx.openai_chatgpt_enterprise?.audit_log?.action_data?.enabled != ''
+ on_failure:
+ - remove:
+ field: openai_chatgpt_enterprise.audit_log.action_data.enabled
+ ignore_missing: true
+ tag: remove_action_data_enabled_on_failure
+ - append:
+ field: error.message
+ value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}'
+ - convert:
+ field: openai_chatgpt_enterprise.audit_log.action_data.include_summary
+ type: boolean
+ ignore_missing: true
+ tag: convert_action_data_include_summary
+ if: ctx.openai_chatgpt_enterprise?.audit_log?.action_data?.include_summary != ''
+ on_failure:
+ - remove:
+ field: openai_chatgpt_enterprise.audit_log.action_data.include_summary
+ ignore_missing: true
+ tag: remove_action_data_include_summary_on_failure
+ - append:
+ field: error.message
+ value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}'
+ - convert:
+ field: openai_chatgpt_enterprise.audit_log.action_data.previous_enabled
+ type: boolean
+ ignore_missing: true
+ tag: convert_action_data_previous_enabled
+ if: ctx.openai_chatgpt_enterprise?.audit_log?.action_data?.previous_enabled != ''
+ on_failure:
+ - remove:
+ field: openai_chatgpt_enterprise.audit_log.action_data.previous_enabled
+ ignore_missing: true
+ tag: remove_action_data_previous_enabled_on_failure
+ - append:
+ field: error.message
+ value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}'
+ - convert:
+ field: openai_chatgpt_enterprise.audit_log.action_data.state_changed
+ type: boolean
+ ignore_missing: true
+ tag: convert_action_data_state_changed
+ if: ctx.openai_chatgpt_enterprise?.audit_log?.action_data?.state_changed != ''
+ on_failure:
+ - remove:
+ field: openai_chatgpt_enterprise.audit_log.action_data.state_changed
+ ignore_missing: true
+ tag: remove_action_data_state_changed_on_failure
+ - append:
+ field: error.message
+ value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}'
+ - convert:
+ field: openai_chatgpt_enterprise.audit_log.action_data.use_workspace_name_for_discovery
+ type: boolean
+ ignore_missing: true
+ tag: convert_action_data_use_workspace_name_for_discovery
+ if: ctx.openai_chatgpt_enterprise?.audit_log?.action_data?.use_workspace_name_for_discovery != ''
+ on_failure:
+ - remove:
+ field: openai_chatgpt_enterprise.audit_log.action_data.use_workspace_name_for_discovery
+ ignore_missing: true
+ tag: remove_action_data_use_workspace_name_for_discovery_on_failure
+ - append:
+ field: error.message
+ value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}'
+ - remove:
+ field:
+ - openai_chatgpt_enterprise.audit_log.action_data.added_user_id
+ - openai_chatgpt_enterprise.audit_log.action_data.allowed_user_id
+ - openai_chatgpt_enterprise.audit_log.action_data.deleted_user_id
+ - openai_chatgpt_enterprise.audit_log.action_data.disallowed_user_id
+ - openai_chatgpt_enterprise.audit_log.action_data.removed_user_id
+ - openai_chatgpt_enterprise.audit_log.action_data.logged_out_user_id
+ - openai_chatgpt_enterprise.audit_log.action_data.new_owner_email
+ - openai_chatgpt_enterprise.audit_log.action_data.file_name
+ - openai_chatgpt_enterprise.audit_log.action_data.mime_type
+ - openai_chatgpt_enterprise.audit_log.request_metadata.client_ja3
+ - openai_chatgpt_enterprise.audit_log.request_metadata.destination_hostname
+ tag: remove_audit_custom_fields_mapped_to_ecs
+ ignore_missing: true
+ - user_agent:
+ field: user_agent.original
+ ignore_missing: true
+ if: ctx.user_agent?.original != null
+ tag: enrich_user_agent
+ - geoip:
+ field: source.ip
+ target_field: source.geo
+ ignore_missing: true
+ if: ctx.source?.ip != null
+ tag: enrich_source_geo
+ - geoip:
+ database_file: GeoLite2-ASN.mmdb
+ field: source.ip
+ target_field: source.as
+ properties:
+ - asn
+ - organization_name
+ ignore_missing: true
+ if: ctx.source?.ip != null
+ tag: enrich_source_asn
+ - rename:
+ field: source.as.asn
+ target_field: source.as.number
+ ignore_missing: true
+ tag: rename_source_asn
+ - rename:
+ field: source.as.organization_name
+ target_field: source.as.organization.name
+ ignore_missing: true
+ tag: rename_source_as_org
+ - append:
+ field: related.ip
+ tag: append_source_ip_to_related
+ value: '{{{source.ip}}}'
+ allow_duplicates: false
+ if: ctx.source?.ip != null
+ - append:
+ field: related.user
+ tag: append_user_email_to_related
+ value: '{{{user.email}}}'
+ allow_duplicates: false
+ if: ctx.user?.email != null
+ - append:
+ field: related.user
+ tag: append_user_id_to_related
+ value: '{{{user.id}}}'
+ allow_duplicates: false
+ if: ctx.user?.id != null
+ - remove:
+ field:
+ - openai_chatgpt_enterprise.audit_log.event_id
+ - openai_chatgpt_enterprise.audit_log.timestamp
+ - openai_chatgpt_enterprise.audit_log.actor.user_id
+ - openai_chatgpt_enterprise.audit_log.actor.user_email
+ - openai_chatgpt_enterprise.audit_log.principal.id
+ - openai_chatgpt_enterprise.audit_log.request_metadata.client_ip
+ - openai_chatgpt_enterprise.audit_log.request_metadata.client_user_agent
+ - openai_chatgpt_enterprise.audit_log.action
+ - openai_chatgpt_enterprise.audit_log.action_data.action
+ - openai_chatgpt_enterprise.audit_log.event_type
+ tag: remove_custom_fields_mapped_to_ecs
+ ignore_missing: true
+ description: Remove custom fields that were copied to ECS fields.
+ - script:
+ lang: painless
+ tag: remove_null_values
+ description: Remove null or empty values from the document.
+ source: |-
+ void handleMap(Map map) {
+ map.values().removeIf(v -> {
+ if (v instanceof Map) {
+ handleMap(v);
+ } else if (v instanceof List) {
+ handleList(v);
+ }
+ return v == null || v == '' || (v instanceof Map && v.size() == 0) || (v instanceof List && v.size() == 0)
+ });
+ }
+ void handleList(List list) {
+ list.removeIf(v -> {
+ if (v instanceof Map) {
+ handleMap(v);
+ } else if (v instanceof List) {
+ handleList(v);
+ }
+ return v == null || v == '' || (v instanceof Map && v.size() == 0) || (v instanceof List && v.size() == 0)
+ });
+ }
+ handleMap(ctx);
+ - append:
+ field: tags
+ tag: append_preserve_on_collector_error
+ value: preserve_original_event
+ allow_duplicates: false
+ if: ctx.error?.message != null
+on_failure:
+ - append:
+ field: error.message
+ value: >-
+ Processor '{{{ _ingest.on_failure_processor_type }}}'
+ {{{#_ingest.on_failure_processor_tag}}}with tag '{{{ _ingest.on_failure_processor_tag }}}'
+ {{{/_ingest.on_failure_processor_tag}}}failed with message '{{{ _ingest.on_failure_message }}}'
+ - set:
+ field: event.kind
+ tag: set_pipeline_error_to_event_kind
+ value: pipeline_error
+ - append:
+ field: tags
+ value: preserve_original_event
+ allow_duplicates: false
diff --git a/packages/openai_chatgpt_enterprise/data_stream/audit_log/fields/base-fields.yml b/packages/openai_chatgpt_enterprise/data_stream/audit_log/fields/base-fields.yml
new file mode 100644
index 00000000000..7fbc126e001
--- /dev/null
+++ b/packages/openai_chatgpt_enterprise/data_stream/audit_log/fields/base-fields.yml
@@ -0,0 +1,16 @@
+- name: data_stream.type
+ external: ecs
+- name: data_stream.dataset
+ external: ecs
+- name: data_stream.namespace
+ external: ecs
+- name: event.module
+ type: constant_keyword
+ external: ecs
+ value: openai_chatgpt_enterprise
+- name: event.dataset
+ type: constant_keyword
+ external: ecs
+ value: openai_chatgpt_enterprise.audit_log
+- name: '@timestamp'
+ external: ecs
diff --git a/packages/openai_chatgpt_enterprise/data_stream/audit_log/fields/beats.yml b/packages/openai_chatgpt_enterprise/data_stream/audit_log/fields/beats.yml
new file mode 100644
index 00000000000..3382e376e77
--- /dev/null
+++ b/packages/openai_chatgpt_enterprise/data_stream/audit_log/fields/beats.yml
@@ -0,0 +1,3 @@
+- name: input.type
+ type: keyword
+ description: Type of filebeat input.
diff --git a/packages/openai_chatgpt_enterprise/data_stream/audit_log/fields/ecs.yml b/packages/openai_chatgpt_enterprise/data_stream/audit_log/fields/ecs.yml
new file mode 100644
index 00000000000..ce3656be6d5
--- /dev/null
+++ b/packages/openai_chatgpt_enterprise/data_stream/audit_log/fields/ecs.yml
@@ -0,0 +1,9 @@
+# Define ECS constant fields as constant_keyword
+- external: ecs
+ name: observer.product
+ type: constant_keyword
+ value: ChatGPT Enterprise Compliance
+- external: ecs
+ name: observer.vendor
+ type: constant_keyword
+ value: OpenAI
diff --git a/packages/openai_chatgpt_enterprise/data_stream/audit_log/fields/fields.yml b/packages/openai_chatgpt_enterprise/data_stream/audit_log/fields/fields.yml
new file mode 100644
index 00000000000..14db60229ae
--- /dev/null
+++ b/packages/openai_chatgpt_enterprise/data_stream/audit_log/fields/fields.yml
@@ -0,0 +1,437 @@
+- name: openai_chatgpt_enterprise.audit_log
+ type: group
+ description: OpenAI ChatGPT Enterprise Audit Logs event fields.
+ fields:
+ - name: action_data
+ type: group
+ description: Action-specific payload; schema varies per action. Empty ({}) for actions such as SESSION_LOGOUT_ALL.
+ fields:
+ - name: affected_connector_ids
+ type: keyword
+ description: Connector IDs whose workspace permissions were affected (APP_PUBLISH / WORKSPACE_TOGGLE_FEATURE).
+ - name: after
+ type: date
+ description: Pagination cursor for list actions (RFC3339 timestamp).
+ - name: after_string
+ type: keyword
+ description: Pagination cursor for list actions (Opaque token).
+ - name: agent_id
+ type: keyword
+ description: Workspace agent identifier.
+ - name: alert_recipients
+ type: group
+ fields:
+ - name: email
+ type: keyword
+ description: Recipient email for usage alerts (SUBSCRIPTION_SET_USAGE_ALERTS).
+ - name: type
+ type: keyword
+ description: Recipient type.
+ - name: alert_thresholds
+ type: group
+ fields:
+ - name: credits
+ type: long
+ description: Credit threshold amount.
+ - name: type
+ type: keyword
+ description: Threshold type.
+ - name: allow_all_in_workspace
+ type: boolean
+ description: Whether the app is visible to the whole workspace (APP_UPDATE_ACCESS_POLICY).
+ - name: allowed_ips
+ type: keyword
+ description: CIDR entries in the IP allowlist (WORKSPACE_SET_*_IP_ALLOWLIST).
+ - name: already_exists
+ type: boolean
+ description: True if a shared conversation already existed (CONVERSATION_SHARE).
+ - name: app_id
+ type: keyword
+ description: App / connector identifier.
+ - name: app_name
+ type: keyword
+ description: App / connector friendly name.
+ - name: auth_user_id
+ type: keyword
+ description: Auth user ID of a memory owner (DELETE_MEMORY).
+ - name: automation_id
+ type: keyword
+ description: Automation identifier.
+ - name: before
+ type: date
+ description: Pagination cursor upper bound for list actions (RFC3339 timestamp).
+ - name: before_string
+ type: keyword
+ description: Pagination cursor upper bound for list actions (Opaque token).
+ - name: changed_fields
+ type: keyword
+ description: List of fields changed by the request.
+ - name: changed_fields_by_connector
+ type: flattened
+ description: Map of connector ID -> changed fields (keys are connector IDs).
+ - name: classification
+ type: keyword
+ description: FedRAMP banner classification string (WORKSPACE_SET_FEDRAMP_BANNER).
+ - name: client_id
+ type: keyword
+ description: Codex remote-control client identifier.
+ - name: codex_environment_id
+ type: keyword
+ description: Codex environment identifier (GET_CODE_ENVIRONMENT).
+ - name: context_plugin_id
+ type: keyword
+ description: Plugin whose UI initiated the action.
+ - name: conversation_id
+ type: keyword
+ description: Conversation identifier.
+ - name: created_at
+ type: date
+ description: Creation time (epoch seconds).
+ - name: created_by_user_id
+ type: keyword
+ description: Auth user ID that created the service account (nullable).
+ - name: credential_id
+ type: keyword
+ description: Credential / personal access token identifier.
+ - name: credential_name
+ type: keyword
+ description: User-provided credential name.
+ - name: credential_type
+ type: keyword
+ description: Credential type.
+ - name: cursor
+ type: keyword
+ description: Pagination cursor (list actions).
+ - name: deactivated_at
+ type: date
+ description: Service account deletion time (epoch seconds) or null.
+ - name: domain_id
+ type: keyword
+ description: Managed domain identifier.
+ - name: domains
+ type: keyword
+ description: Allowed action domains for a GPT (may be null to clear).
+ - name: email_address
+ type: keyword
+ description: Single email address (invite actions).
+ - name: email_addresses
+ type: keyword
+ description: List of email addresses (invite / group actions).
+ - name: enabled
+ type: boolean
+ description: Enabled / active state after the change.
+ - name: environment_id
+ type: keyword
+ description: Environment identifier.
+ - name: event_type
+ type: keyword
+ description: 'Compliance event category: filter list (array) or resolved category (download, string).'
+ - name: expires_at
+ type: date
+ description: Credential expiration time (epoch seconds) or null.
+ - name: feature
+ type: keyword
+ description: Feature / flag identifier toggled (WORKSPACE_TOGGLE_FEATURE / WORKSPACE_SET_SHARING_PERMISSION).
+ - name: file_format
+ type: keyword
+ description: File output mode.
+ - name: file_id
+ type: keyword
+ description: File identifier.
+ - name: gpt_id
+ type: keyword
+ description: GPT identifier.
+ - name: group_id
+ type: keyword
+ description: Group identifier.
+ - name: hostname
+ type: keyword
+ description: Domain hostname added (DOMAIN_CREATE).
+ - name: id
+ type: keyword
+ description: Resource identifier (GPT / project) for the action.
+ - name: include_summary
+ type: boolean
+ description: Whether recording summary sections are included (DOWNLOAD_RECORDING_TRANSCRIPT).
+ - name: installation_policy
+ type: keyword
+ description: Plugin installation policy after the update.
+ - name: installation_policy_before
+ type: keyword
+ description: Plugin installation policy before the update.
+ - name: installed_by_default_role_ids
+ type: keyword
+ description: Role IDs the plugin is installed for by default (after).
+ - name: installed_by_default_role_ids_before
+ type: keyword
+ description: Role IDs the plugin was installed for by default (before).
+ - name: knowledge_app_type
+ type: keyword
+ description: App backend / type provisioned (APP_CREATE).
+ - name: limit
+ type: long
+ description: Requested page size (list actions).
+ - name: log_file_id
+ type: keyword
+ description: Compliance log file identifier (download actions).
+ - name: markdown
+ type: keyword
+ description: FedRAMP banner markdown body.
+ - name: memory_context_id
+ type: keyword
+ description: Memory context identifier (DELETE_MEMORY).
+ - name: memory_id
+ type: keyword
+ description: Memory identifier.
+ - name: message_id
+ type: keyword
+ description: Message identifier (rating actions).
+ - name: name
+ type: keyword
+ description: Resource / service-account / credential name.
+ - name: new_name
+ type: keyword
+ description: New / updated name.
+ - name: new_role
+ type: keyword
+ description: Role assigned to the user (USER_ROLE_UPDATED).
+ - name: new_workspace_permissions_by_connector
+ type: flattened
+ description: Map of connector ID -> permission snapshot after the change.
+ - name: old_name
+ type: keyword
+ description: Previous name before the change.
+ - name: order
+ type: keyword
+ description: Sort order (list directory actions).
+ - name: overage_limit_credits
+ type: keyword
+ description: 'Credit overage limit, integer or the string unlimited.'
+ - name: owner_id
+ type: keyword
+ description: Owner filter / owner user ID (list agents etc.).
+ - name: owner_user_id
+ type: keyword
+ description: Auth user ID of the credential owner.
+ - name: plugin_id
+ type: keyword
+ description: Plugin identifier.
+ - name: previous_enabled
+ type: boolean
+ description: Service account active state before the update.
+ - name: previous_name
+ type: keyword
+ description: Service account name before the update (nullable).
+ - name: previous_role
+ type: keyword
+ description: Previous role for a share target (nullable) (SKILL_SHARE).
+ - name: previous_workspace_permissions_by_connector
+ type: flattened
+ description: Map of connector ID -> permission snapshot before the change.
+ - name: principal_id
+ type: keyword
+ description: Principal (user or group) identifier for a share target.
+ - name: principal_type
+ type: keyword
+ description: 'Principal type: user or group.'
+ - name: project_id
+ type: keyword
+ description: Project identifier.
+ - name: public_display_name
+ type: keyword
+ description: External display name (WORKSPACE_SET_IS_DISCOVERABLE).
+ - name: rating
+ type: keyword
+ description: Message rating.
+ - name: recording_id
+ type: keyword
+ description: Recording identifier.
+ - name: remote_thread_id
+ type: keyword
+ description: Codex remote-control thread identifier.
+ - name: requested_access_removals
+ type: group
+ fields:
+ - name: recipient_type
+ type: keyword
+ description: Recipient type requested for removal (PROJECT_UPDATE_SHARING).
+ - name: user_id
+ type: keyword
+ description: User ID requested for removal.
+ - name: requested_access_updates
+ type: group
+ fields:
+ - name: capabilities
+ type: keyword
+ description: Capabilities requested for the recipient.
+ - name: recipient_type
+ type: keyword
+ description: Recipient type requested to add/update.
+ - name: user_id
+ type: keyword
+ description: User ID requested to add/update.
+ - name: revoked_at
+ type: date
+ description: Revocation time (epoch seconds) or null.
+ - name: revoked_unified_sessions
+ type: keyword
+ description: Unified session IDs revoked (SESSION_REVOKE).
+ - name: role
+ type: keyword
+ description: Role granted / removed (manager or user; or invite role).
+ - name: room_id
+ type: keyword
+ description: Project chat room identifier.
+ - name: scope_id
+ type: keyword
+ description: Connector scope identifier (DELETE_PROJECT_CONNECTOR_SCOPE).
+ - name: scopes
+ type: keyword
+ description: Product-access scopes on the credential (sorted, deduplicated).
+ - name: service_account_id
+ type: keyword
+ description: Service account auth user ID.
+ - name: session_id
+ type: keyword
+ description: Session identifier (SESSION_REVOKE).
+ - name: shared_conversation_id
+ type: keyword
+ description: Shared conversation identifier (CONVERSATION_SHARE / view).
+ - name: shared_to
+ type: group
+ fields:
+ - name: capabilities
+ type: keyword
+ description: Capabilities granted to the recipient segment.
+ - name: group_id
+ type: keyword
+ description: Group ID recipient (sharing).
+ - name: recipient_type
+ type: keyword
+ description: 'Recipient type (UPDATE_SHARING).'
+ - name: type
+ type: keyword
+ description: 'Recipient segment type (CHANGE_VISIBILITY).'
+ - name: sign_in_endpoint
+ type: keyword
+ description: SAML sign-in endpoint URL / SCIM connection identifier.
+ - name: since_timestamp
+ type: date
+ description: Lower-bound timestamp filter (list actions).
+ - name: skill_id
+ type: keyword
+ description: Skill identifier.
+ - name: skill_name
+ type: keyword
+ description: Skill name.
+ - name: source_surface
+ type: keyword
+ description: Admin surface that initiated the action (admin_apps or admin_plugins).
+ - name: state_changed
+ type: boolean
+ description: Whether the successful request performed the initial revoke transition.
+ - name: system_instruction
+ type: keyword
+ description: Workspace default system prompt (WORKSPACE_SET_SYSTEM_INSTRUCTION).
+ - name: task_id
+ type: keyword
+ description: Codex task identifier.
+ - name: textdoc_id
+ type: keyword
+ description: Canvas text document identifier.
+ - name: third_party_gizmo_id
+ type: keyword
+ description: Third-party GPT identifier.
+ - name: total_requested
+ type: long
+ description: Count of join requests approved (INVITE_ACCEPT_ALL).
+ - name: use_workspace_name_for_discovery
+ type: boolean
+ description: Whether the workspace name is reused for discovery.
+ - name: user_id
+ type: keyword
+ description: Auth user ID targeted by the action.
+ - name: value
+ type: keyword
+ description: Generic value payload (boolean/string) for toggle/set actions.
+ - name: value_bool
+ type: boolean
+ description: Boolean form of action_data.value (populated when the changed value is a boolean).
+ - name: workspace_access_state
+ type: keyword
+ description: 'Skill workspace access state: restricted / discoverable / enabled.'
+ - name: workspace_id
+ type: keyword
+ description: Workspace identifier.
+ - name: workspace_policy
+ type: keyword
+ description: Workspace policy document or identifier (WORKSPACE_SET_POLICY).
+ - name: action_privilege
+ type: keyword
+ description: 'Privilege level for the action: ADMIN or STANDARD_USER.'
+ - name: action_result
+ type: keyword
+ description: 'Outcome of the action: SUCCESS, BLOCKED, or ERROR.'
+ - name: actor
+ type: group
+ fields:
+ - name: redacted_id
+ type: keyword
+ description: Redacted identifier of the API key (present when actor.type = API_KEY).
+ - name: type
+ type: keyword
+ description: Type of actor that performed the action (e.g. ACCOUNT_USER, API_KEY).
+ - name: app_id
+ type: keyword
+ description: Identifier of the connected app / connector.
+ - name: client_id
+ type: keyword
+ description: Codex client identifier associated with the event.
+ - name: event_details
+ type: group
+ fields:
+ - name: detail_type
+ type: keyword
+ description: Discriminator identifying the specific Codex event-details schema.
+ - name: principal
+ type: group
+ fields:
+ - name: type
+ type: keyword
+ description: Principal that owns the event (e.g. CHATGPT_WORKSPACE).
+ - name: request_metadata
+ type: group
+ fields:
+ - name: client_ip_details
+ type: group
+ fields:
+ - name: asn
+ type: keyword
+ description: Autonomous System Number resolved from the client IP.
+ - name: city
+ type: keyword
+ description: City resolved from the client IP.
+ - name: country
+ type: keyword
+ description: Country resolved from the client IP.
+ - name: latitude
+ type: keyword
+ description: Latitude resolved from the client IP.
+ - name: longitude
+ type: keyword
+ description: Longitude resolved from the client IP.
+ - name: region
+ type: keyword
+ description: Region / state resolved from the client IP.
+ - name: region_code
+ type: keyword
+ description: Region / state code resolved from the client IP.
+ - name: client_ja4
+ type: keyword
+ description: JA4 TLS fingerprint of the client (may be empty).
+ - name: type
+ type: keyword
+ description: 'Top-level event category (APP_LOG, APP_AUTH_LOG, AUDIT_LOG, AUTH_LOG, CODEX_LOG, CODEX_SECURITY_LOG).'
+ - name: workspace_id
+ type: keyword
+ description: Workspace identifier associated with the event.
diff --git a/packages/openai_chatgpt_enterprise/data_stream/audit_log/manifest.yml b/packages/openai_chatgpt_enterprise/data_stream/audit_log/manifest.yml
new file mode 100644
index 00000000000..b3624e49526
--- /dev/null
+++ b/packages/openai_chatgpt_enterprise/data_stream/audit_log/manifest.yml
@@ -0,0 +1,98 @@
+title: Audit Logs
+type: logs
+streams:
+ - input: cel
+ title: Audit Logs
+ enabled: true
+ description: Collect Audit Logs from the OpenAI ChatGPT Enterprise Compliance Logs Platform.
+ template_path: cel.yml.hbs
+ vars:
+ - name: scope
+ type: select
+ title: Scope
+ description: >-
+ Whether to collect compliance logs at the `workspace` or `organization` level.
+ multi: false
+ required: true
+ show_user: true
+ default: workspace
+ options:
+ - value: workspace
+ text: Workspace
+ - value: organization
+ text: Organization
+ - name: resource_id
+ type: text
+ title: Workspace / Organization ID
+ description: >-
+ The ChatGPT Enterprise workspace ID (when Scope is `workspace`) or the organization ID (when Scope is `organization`) whose compliance logs will be collected.
+ multi: false
+ required: true
+ show_user: true
+ - name: initial_interval
+ type: text
+ title: Initial Interval
+ description: How far back to pull compliance logs on first run. Supported units are h/m/s.
+ multi: false
+ required: true
+ show_user: true
+ default: 24h
+ - name: interval
+ type: text
+ title: Interval
+ description: Duration between requests to the OpenAI Compliance Logs Platform API. Supported units for this parameter are h/m/s.
+ default: 24h
+ multi: false
+ required: true
+ show_user: true
+ - name: batch_size
+ type: integer
+ title: Batch Size
+ description: Number of log files to request per listing page. This should be between 1 and 100.
+ default: 100
+ multi: false
+ required: true
+ show_user: false
+ - name: http_client_timeout
+ type: text
+ title: HTTP Client Timeout
+ description: Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h.
+ multi: false
+ required: true
+ show_user: false
+ default: 30s
+ - name: enable_request_tracer
+ type: bool
+ title: Enable request tracing
+ default: false
+ multi: false
+ required: false
+ show_user: false
+ description: >-
+ The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. Disabling the request tracer will delete any stored traces. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-cel.html#_resource_tracer_enable) for details.
+ - name: tags
+ type: text
+ title: Tags
+ description: Tags for the data-stream.
+ multi: true
+ required: true
+ show_user: false
+ default:
+ - forwarded
+ - openai_chatgpt_enterprise-audit_log
+ - name: preserve_original_event
+ required: false
+ show_user: true
+ title: Preserve original event
+ description: Preserves a raw copy of the original event, added to the field `event.original`.
+ type: bool
+ multi: false
+ default: false
+ - name: processors
+ type: yaml
+ title: Processors
+ multi: false
+ required: false
+ show_user: false
+ description: >-
+ Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.
diff --git a/packages/openai_chatgpt_enterprise/data_stream/audit_log/sample_event.json b/packages/openai_chatgpt_enterprise/data_stream/audit_log/sample_event.json
new file mode 100644
index 00000000000..1069d8783d5
--- /dev/null
+++ b/packages/openai_chatgpt_enterprise/data_stream/audit_log/sample_event.json
@@ -0,0 +1,119 @@
+{
+ "@timestamp": "2026-07-09T11:05:09.077Z",
+ "agent": {
+ "ephemeral_id": "d4290824-0b37-43b5-b718-bd38f7ba6230",
+ "id": "ad657795-fbcc-4049-a6ac-d65abc851b66",
+ "name": "elastic-agent-57701",
+ "type": "filebeat",
+ "version": "8.19.0"
+ },
+ "data_stream": {
+ "dataset": "openai_chatgpt_enterprise.audit_log",
+ "namespace": "43110",
+ "type": "logs"
+ },
+ "destination": {
+ "domain": "api.chatgpt.com"
+ },
+ "ecs": {
+ "version": "9.4.0"
+ },
+ "elastic_agent": {
+ "id": "ad657795-fbcc-4049-a6ac-d65abc851b66",
+ "snapshot": false,
+ "version": "8.19.0"
+ },
+ "event": {
+ "action": "list_workspace_log_files",
+ "agent_id_status": "verified",
+ "category": [
+ "iam"
+ ],
+ "dataset": "openai_chatgpt_enterprise.audit_log",
+ "id": "92b7dea7-9ff4-485e-b0a0-74efa627f15b",
+ "ingested": "2026-07-19T18:48:30Z",
+ "kind": "event",
+ "original": "{\"event_id\":\"92b7dea7-9ff4-485e-b0a0-74efa627f15b\",\"type\":\"AUDIT_LOG\",\"principal\":{\"id\":\"be545252-ad04-4cfa-9ca5-deca58416151\",\"type\":\"CHATGPT_WORKSPACE\"},\"actor\":{\"type\":\"API_KEY\",\"redacted_id\":\"sk-...RxIA\"},\"timestamp\":\"2026-07-09T11:05:09.077133Z\",\"action_result\":\"SUCCESS\",\"action_privilege\":\"ADMIN\",\"request_metadata\":{\"client_ip\":\"81.2.69.142\",\"client_ip_details\":{\"country\":\"GB\",\"city\":\"London\",\"region\":\"England\",\"region_code\":\"ENG\",\"asn\":\"\",\"latitude\":\"51.50853\",\"longitude\":\"-0.12574\"},\"client_user_agent\":\"python-requests/2.34.2\",\"client_ja3\":\"86dab2109182b6bbaa644647d7db2997\",\"client_ja4\":\"t13d1713h1_ab0a1bf427ad_8537cf56674e\",\"destination_hostname\":\"api.chatgpt.com\"},\"action_data\":{\"limit\":\"100\",\"after\":\"2026-07-09T10:24:53.814285Z\",\"event_type\":\"AUDIT_LOG\"},\"action\":\"LIST_WORKSPACE_LOG_FILES\"}",
+ "outcome": "success",
+ "type": [
+ "info"
+ ]
+ },
+ "gen_ai": {
+ "system": "openai"
+ },
+ "input": {
+ "type": "cel"
+ },
+ "openai_chatgpt_enterprise": {
+ "audit_log": {
+ "action_data": {
+ "after": "2026-07-09T10:24:53.814Z",
+ "event_type": "AUDIT_LOG",
+ "limit": 100
+ },
+ "action_privilege": "ADMIN",
+ "action_result": "SUCCESS",
+ "actor": {
+ "redacted_id": "sk-...RxIA",
+ "type": "API_KEY"
+ },
+ "principal": {
+ "type": "CHATGPT_WORKSPACE"
+ },
+ "request_metadata": {
+ "client_ip_details": {
+ "city": "London",
+ "country": "GB",
+ "latitude": "51.50853",
+ "longitude": "-0.12574",
+ "region": "England",
+ "region_code": "ENG"
+ },
+ "client_ja4": "t13d1713h1_ab0a1bf427ad_8537cf56674e"
+ },
+ "type": "AUDIT_LOG"
+ }
+ },
+ "organization": {
+ "id": "be545252-ad04-4cfa-9ca5-deca58416151"
+ },
+ "related": {
+ "ip": [
+ "81.2.69.142"
+ ]
+ },
+ "source": {
+ "geo": {
+ "city_name": "London",
+ "continent_name": "Europe",
+ "country_iso_code": "GB",
+ "country_name": "United Kingdom",
+ "location": {
+ "lat": 51.5142,
+ "lon": -0.0931
+ },
+ "region_iso_code": "GB-ENG",
+ "region_name": "England"
+ },
+ "ip": "81.2.69.142"
+ },
+ "tags": [
+ "preserve_original_event",
+ "forwarded",
+ "openai_chatgpt_enterprise-audit_log"
+ ],
+ "tls": {
+ "client": {
+ "ja3": "86dab2109182b6bbaa644647d7db2997"
+ }
+ },
+ "user_agent": {
+ "device": {
+ "name": "Other"
+ },
+ "name": "Python Requests",
+ "original": "python-requests/2.34.2",
+ "version": "2.34"
+ }
+}
diff --git a/packages/openai_chatgpt_enterprise/docs/README.md b/packages/openai_chatgpt_enterprise/docs/README.md
new file mode 100644
index 00000000000..d45c91b39d0
--- /dev/null
+++ b/packages/openai_chatgpt_enterprise/docs/README.md
@@ -0,0 +1,403 @@
+# OpenAI ChatGPT Enterprise Integration for Elastic
+
+## Overview
+
+[OpenAI ChatGPT Enterprise](https://openai.com/chatgpt/enterprise/) is the enterprise offering of ChatGPT, providing workspace administration, security controls, and compliance capabilities for organizations. The [Compliance Logs Platform](https://help.openai.com/en/articles/9261474-compliance-api-for-enterprise-customers) exposes the compliance events generated across a workspace or organization, including administrative activity, authentication, application access, and Codex activity.
+
+This integration for Elastic allows you to collect ChatGPT Enterprise compliance logs using the OpenAI Compliance Logs Platform API, then visualize the data in Kibana.
+
+### Compatibility
+
+This integration is compatible with the OpenAI Compliance Logs Platform API for ChatGPT Enterprise customers.
+
+### How it works
+
+This integration periodically queries the OpenAI Compliance Logs Platform API to retrieve compliance logs. Collection is a two-step (chained) process: the integration first lists the available log files for the configured event type, then downloads each log file and emits every JSON Lines record it contains as an individual event.
+
+## What data does this integration collect?
+
+This integration collects log messages of the following type:
+
+- `Audit Logs`: Collect administrative and workspace audit activity (event type: `AUDIT_LOG`) from the OpenAI Compliance Logs Platform. Each audit event captures the action performed, the acting principal, the outcome, and request metadata such as client IP and user agent.
+
+### Supported use cases
+
+Bringing OpenAI ChatGPT Enterprise Audit Logs into Elastic gives security and compliance teams a searchable, correlatable record of administrative and workspace activity. Audit events describe who performed which action, on which resource, from where, and whether the action succeeded, was blocked, or failed.
+
+Use the `audit_log` data stream to monitor privileged administrative actions (role changes, application access grants, feature toggles, invitations, and workspace policy updates), investigate suspicious activity by user, IP, or geography, and track outcome trends over time. Bundled dashboards summarize activity volume, top actions, top users, action outcomes, and source geography for day-to-day monitoring and investigation.
+
+## What do I need to use this integration?
+
+### From OpenAI
+
+To collect data through the OpenAI Compliance Logs Platform API, you need a **Compliance API key** authorized for enterprise logs and the **Workspace ID** or **Organization ID** whose compliance logs you want to collect.
+
+1. Ensure your account has access to the [Compliance API for enterprise customers](https://help.openai.com/en/articles/9261474-compliance-api-for-enterprise-customers).
+2. Generate a **Compliance API key** authorized for enterprise logs.
+3. Obtain the **Workspace ID** (when Scope is `workspace`) or the **Organization ID** (when Scope is `organization`) whose logs will be collected.
+4. Store these values securely for use in the integration configuration.
+
+## How do I deploy this integration?
+
+This integration supports both Elastic Agentless-based and Agent-based installations.
+
+### Agent-based deployment
+
+Elastic Agent must be installed. For more details, check the Elastic Agent [installation instructions](docs-content://reference/fleet/install-elastic-agents.md). You can install only one Elastic Agent per host.
+
+Elastic Agent is required to stream data from the OpenAI Compliance Logs Platform API and ship the data to Elastic, where the events will then be processed via the integration's ingest pipelines.
+
+### Agentless deployment
+
+Agentless deployments are only supported in Elastic Serverless and Elastic Cloud environments. Agentless deployments provide a means to ingest data while avoiding the orchestration, management, and maintenance needs associated with standard ingest infrastructure. Using an agentless deployment makes manual agent deployment unnecessary, allowing you to focus on your data instead of the agent that collects it.
+
+For more information, refer to [Agentless integrations](https://www.elastic.co/guide/en/serverless/current/security-agentless-integrations.html) and [Agentless integrations FAQ](https://www.elastic.co/guide/en/serverless/current/agentless-integration-troubleshooting.html)
+
+### Configure
+
+1. In the top search bar in Kibana, search for **Integrations**.
+2. In the search bar, type **OpenAI ChatGPT Enterprise**.
+3. Select the **OpenAI ChatGPT Enterprise** integration from the search results.
+4. Select **Add OpenAI ChatGPT Enterprise** to add the integration.
+5. Enable and configure the collection method:
+
+ * To **Collect ChatGPT Enterprise compliance logs**, you'll need to:
+
+ - Configure the **URL** and **Compliance API key**.
+ - Set the **Scope** (`workspace` or `organization`) and the corresponding **Workspace / Organization ID**.
+ - Adjust the integration configuration parameters if required, including the Interval, Initial Interval, and HTTP Client Timeout to enable data collection.
+
+6. Select **Save and continue** to save the integration.
+
+### Validation
+
+#### Dashboard populated
+
+1. In the top search bar in Kibana, search for **Dashboards**.
+2. In the search bar, type **OpenAI ChatGPT Enterprise**, and verify the dashboard information is populated.
+
+## Troubleshooting
+
+For help with Elastic ingest tools, check [Common problems](https://www.elastic.co/docs/troubleshoot/ingest/fleet/common-problems).
+
+## Scaling
+
+For more information on architectures that can be used for scaling this integration, check the [Ingest Architectures](https://www.elastic.co/docs/manage-data/ingest/ingest-reference-architectures) documentation.
+
+## Reference
+
+### Audit Logs
+
+The `audit_log` data stream provides administrative and workspace audit events from the OpenAI ChatGPT Enterprise Compliance Logs Platform.
+
+#### Audit Log fields
+
+**Exported fields**
+
+| Field | Description | Type |
+|---|---|---|
+| @timestamp | Date/time when the event originated. This is the date/time extracted from the event, typically representing when the event was generated by the source. If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline. Required field for all events. | date |
+| data_stream.dataset | The field can contain anything that makes sense to signify the source of the data. Examples include `nginx.access`, `prometheus`, `endpoint` etc. For data streams that otherwise fit, but that do not have dataset set we use the value "generic" for the dataset value. `event.dataset` should have the same value as `data_stream.dataset`. Beyond the Elasticsearch data stream naming criteria noted above, the `dataset` value has additional restrictions: \* Must not contain `-` \* No longer than 100 characters | constant_keyword |
+| data_stream.namespace | A user defined namespace. Namespaces are useful to allow grouping of data. Many users already organize their indices this way, and the data stream naming scheme now provides this best practice as a default. Many users will populate this field with `default`. If no value is used, it falls back to `default`. Beyond the Elasticsearch index naming criteria noted above, `namespace` value has the additional restrictions: \* Must not contain `-` \* No longer than 100 characters | constant_keyword |
+| data_stream.type | An overarching type for the data stream. Currently allowed values are "logs" and "metrics". We expect to also add "traces" and "synthetics" in the near future. | constant_keyword |
+| event.dataset | Name of the dataset. If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from. It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name. | constant_keyword |
+| event.module | Name of the module this data is coming from. If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module. | constant_keyword |
+| input.type | Type of filebeat input. | keyword |
+| observer.product | The product name of the observer. | constant_keyword |
+| observer.vendor | Vendor name of the observer. | constant_keyword |
+| openai_chatgpt_enterprise.audit_log.action_data.affected_connector_ids | Connector IDs whose workspace permissions were affected (APP_PUBLISH / WORKSPACE_TOGGLE_FEATURE). | keyword |
+| openai_chatgpt_enterprise.audit_log.action_data.after | Pagination cursor for list actions (RFC3339 timestamp). | date |
+| openai_chatgpt_enterprise.audit_log.action_data.after_string | Pagination cursor for list actions (Opaque token). | keyword |
+| openai_chatgpt_enterprise.audit_log.action_data.agent_id | Workspace agent identifier. | keyword |
+| openai_chatgpt_enterprise.audit_log.action_data.alert_recipients.email | Recipient email for usage alerts (SUBSCRIPTION_SET_USAGE_ALERTS). | keyword |
+| openai_chatgpt_enterprise.audit_log.action_data.alert_recipients.type | Recipient type. | keyword |
+| openai_chatgpt_enterprise.audit_log.action_data.alert_thresholds.credits | Credit threshold amount. | long |
+| openai_chatgpt_enterprise.audit_log.action_data.alert_thresholds.type | Threshold type. | keyword |
+| openai_chatgpt_enterprise.audit_log.action_data.allow_all_in_workspace | Whether the app is visible to the whole workspace (APP_UPDATE_ACCESS_POLICY). | boolean |
+| openai_chatgpt_enterprise.audit_log.action_data.allowed_ips | CIDR entries in the IP allowlist (WORKSPACE_SET_\*_IP_ALLOWLIST). | keyword |
+| openai_chatgpt_enterprise.audit_log.action_data.already_exists | True if a shared conversation already existed (CONVERSATION_SHARE). | boolean |
+| openai_chatgpt_enterprise.audit_log.action_data.app_id | App / connector identifier. | keyword |
+| openai_chatgpt_enterprise.audit_log.action_data.app_name | App / connector friendly name. | keyword |
+| openai_chatgpt_enterprise.audit_log.action_data.auth_user_id | Auth user ID of a memory owner (DELETE_MEMORY). | keyword |
+| openai_chatgpt_enterprise.audit_log.action_data.automation_id | Automation identifier. | keyword |
+| openai_chatgpt_enterprise.audit_log.action_data.before | Pagination cursor upper bound for list actions (RFC3339 timestamp). | date |
+| openai_chatgpt_enterprise.audit_log.action_data.before_string | Pagination cursor upper bound for list actions (Opaque token). | keyword |
+| openai_chatgpt_enterprise.audit_log.action_data.changed_fields | List of fields changed by the request. | keyword |
+| openai_chatgpt_enterprise.audit_log.action_data.changed_fields_by_connector | Map of connector ID -\> changed fields (keys are connector IDs). | flattened |
+| openai_chatgpt_enterprise.audit_log.action_data.classification | FedRAMP banner classification string (WORKSPACE_SET_FEDRAMP_BANNER). | keyword |
+| openai_chatgpt_enterprise.audit_log.action_data.client_id | Codex remote-control client identifier. | keyword |
+| openai_chatgpt_enterprise.audit_log.action_data.codex_environment_id | Codex environment identifier (GET_CODE_ENVIRONMENT). | keyword |
+| openai_chatgpt_enterprise.audit_log.action_data.context_plugin_id | Plugin whose UI initiated the action. | keyword |
+| openai_chatgpt_enterprise.audit_log.action_data.conversation_id | Conversation identifier. | keyword |
+| openai_chatgpt_enterprise.audit_log.action_data.created_at | Creation time (epoch seconds). | date |
+| openai_chatgpt_enterprise.audit_log.action_data.created_by_user_id | Auth user ID that created the service account (nullable). | keyword |
+| openai_chatgpt_enterprise.audit_log.action_data.credential_id | Credential / personal access token identifier. | keyword |
+| openai_chatgpt_enterprise.audit_log.action_data.credential_name | User-provided credential name. | keyword |
+| openai_chatgpt_enterprise.audit_log.action_data.credential_type | Credential type. | keyword |
+| openai_chatgpt_enterprise.audit_log.action_data.cursor | Pagination cursor (list actions). | keyword |
+| openai_chatgpt_enterprise.audit_log.action_data.deactivated_at | Service account deletion time (epoch seconds) or null. | date |
+| openai_chatgpt_enterprise.audit_log.action_data.domain_id | Managed domain identifier. | keyword |
+| openai_chatgpt_enterprise.audit_log.action_data.domains | Allowed action domains for a GPT (may be null to clear). | keyword |
+| openai_chatgpt_enterprise.audit_log.action_data.email_address | Single email address (invite actions). | keyword |
+| openai_chatgpt_enterprise.audit_log.action_data.email_addresses | List of email addresses (invite / group actions). | keyword |
+| openai_chatgpt_enterprise.audit_log.action_data.enabled | Enabled / active state after the change. | boolean |
+| openai_chatgpt_enterprise.audit_log.action_data.environment_id | Environment identifier. | keyword |
+| openai_chatgpt_enterprise.audit_log.action_data.event_type | Compliance event category: filter list (array) or resolved category (download, string). | keyword |
+| openai_chatgpt_enterprise.audit_log.action_data.expires_at | Credential expiration time (epoch seconds) or null. | date |
+| openai_chatgpt_enterprise.audit_log.action_data.feature | Feature / flag identifier toggled (WORKSPACE_TOGGLE_FEATURE / WORKSPACE_SET_SHARING_PERMISSION). | keyword |
+| openai_chatgpt_enterprise.audit_log.action_data.file_format | File output mode. | keyword |
+| openai_chatgpt_enterprise.audit_log.action_data.file_id | File identifier. | keyword |
+| openai_chatgpt_enterprise.audit_log.action_data.gpt_id | GPT identifier. | keyword |
+| openai_chatgpt_enterprise.audit_log.action_data.group_id | Group identifier. | keyword |
+| openai_chatgpt_enterprise.audit_log.action_data.hostname | Domain hostname added (DOMAIN_CREATE). | keyword |
+| openai_chatgpt_enterprise.audit_log.action_data.id | Resource identifier (GPT / project) for the action. | keyword |
+| openai_chatgpt_enterprise.audit_log.action_data.include_summary | Whether recording summary sections are included (DOWNLOAD_RECORDING_TRANSCRIPT). | boolean |
+| openai_chatgpt_enterprise.audit_log.action_data.installation_policy | Plugin installation policy after the update. | keyword |
+| openai_chatgpt_enterprise.audit_log.action_data.installation_policy_before | Plugin installation policy before the update. | keyword |
+| openai_chatgpt_enterprise.audit_log.action_data.installed_by_default_role_ids | Role IDs the plugin is installed for by default (after). | keyword |
+| openai_chatgpt_enterprise.audit_log.action_data.installed_by_default_role_ids_before | Role IDs the plugin was installed for by default (before). | keyword |
+| openai_chatgpt_enterprise.audit_log.action_data.knowledge_app_type | App backend / type provisioned (APP_CREATE). | keyword |
+| openai_chatgpt_enterprise.audit_log.action_data.limit | Requested page size (list actions). | long |
+| openai_chatgpt_enterprise.audit_log.action_data.log_file_id | Compliance log file identifier (download actions). | keyword |
+| openai_chatgpt_enterprise.audit_log.action_data.markdown | FedRAMP banner markdown body. | keyword |
+| openai_chatgpt_enterprise.audit_log.action_data.memory_context_id | Memory context identifier (DELETE_MEMORY). | keyword |
+| openai_chatgpt_enterprise.audit_log.action_data.memory_id | Memory identifier. | keyword |
+| openai_chatgpt_enterprise.audit_log.action_data.message_id | Message identifier (rating actions). | keyword |
+| openai_chatgpt_enterprise.audit_log.action_data.name | Resource / service-account / credential name. | keyword |
+| openai_chatgpt_enterprise.audit_log.action_data.new_name | New / updated name. | keyword |
+| openai_chatgpt_enterprise.audit_log.action_data.new_role | Role assigned to the user (USER_ROLE_UPDATED). | keyword |
+| openai_chatgpt_enterprise.audit_log.action_data.new_workspace_permissions_by_connector | Map of connector ID -\> permission snapshot after the change. | flattened |
+| openai_chatgpt_enterprise.audit_log.action_data.old_name | Previous name before the change. | keyword |
+| openai_chatgpt_enterprise.audit_log.action_data.order | Sort order (list directory actions). | keyword |
+| openai_chatgpt_enterprise.audit_log.action_data.overage_limit_credits | Credit overage limit, integer or the string unlimited. | keyword |
+| openai_chatgpt_enterprise.audit_log.action_data.owner_id | Owner filter / owner user ID (list agents etc.). | keyword |
+| openai_chatgpt_enterprise.audit_log.action_data.owner_user_id | Auth user ID of the credential owner. | keyword |
+| openai_chatgpt_enterprise.audit_log.action_data.plugin_id | Plugin identifier. | keyword |
+| openai_chatgpt_enterprise.audit_log.action_data.previous_enabled | Service account active state before the update. | boolean |
+| openai_chatgpt_enterprise.audit_log.action_data.previous_name | Service account name before the update (nullable). | keyword |
+| openai_chatgpt_enterprise.audit_log.action_data.previous_role | Previous role for a share target (nullable) (SKILL_SHARE). | keyword |
+| openai_chatgpt_enterprise.audit_log.action_data.previous_workspace_permissions_by_connector | Map of connector ID -\> permission snapshot before the change. | flattened |
+| openai_chatgpt_enterprise.audit_log.action_data.principal_id | Principal (user or group) identifier for a share target. | keyword |
+| openai_chatgpt_enterprise.audit_log.action_data.principal_type | Principal type: user or group. | keyword |
+| openai_chatgpt_enterprise.audit_log.action_data.project_id | Project identifier. | keyword |
+| openai_chatgpt_enterprise.audit_log.action_data.public_display_name | External display name (WORKSPACE_SET_IS_DISCOVERABLE). | keyword |
+| openai_chatgpt_enterprise.audit_log.action_data.rating | Message rating. | keyword |
+| openai_chatgpt_enterprise.audit_log.action_data.recording_id | Recording identifier. | keyword |
+| openai_chatgpt_enterprise.audit_log.action_data.remote_thread_id | Codex remote-control thread identifier. | keyword |
+| openai_chatgpt_enterprise.audit_log.action_data.requested_access_removals.recipient_type | Recipient type requested for removal (PROJECT_UPDATE_SHARING). | keyword |
+| openai_chatgpt_enterprise.audit_log.action_data.requested_access_removals.user_id | User ID requested for removal. | keyword |
+| openai_chatgpt_enterprise.audit_log.action_data.requested_access_updates.capabilities | Capabilities requested for the recipient. | keyword |
+| openai_chatgpt_enterprise.audit_log.action_data.requested_access_updates.recipient_type | Recipient type requested to add/update. | keyword |
+| openai_chatgpt_enterprise.audit_log.action_data.requested_access_updates.user_id | User ID requested to add/update. | keyword |
+| openai_chatgpt_enterprise.audit_log.action_data.revoked_at | Revocation time (epoch seconds) or null. | date |
+| openai_chatgpt_enterprise.audit_log.action_data.revoked_unified_sessions | Unified session IDs revoked (SESSION_REVOKE). | keyword |
+| openai_chatgpt_enterprise.audit_log.action_data.role | Role granted / removed (manager or user; or invite role). | keyword |
+| openai_chatgpt_enterprise.audit_log.action_data.room_id | Project chat room identifier. | keyword |
+| openai_chatgpt_enterprise.audit_log.action_data.scope_id | Connector scope identifier (DELETE_PROJECT_CONNECTOR_SCOPE). | keyword |
+| openai_chatgpt_enterprise.audit_log.action_data.scopes | Product-access scopes on the credential (sorted, deduplicated). | keyword |
+| openai_chatgpt_enterprise.audit_log.action_data.service_account_id | Service account auth user ID. | keyword |
+| openai_chatgpt_enterprise.audit_log.action_data.session_id | Session identifier (SESSION_REVOKE). | keyword |
+| openai_chatgpt_enterprise.audit_log.action_data.shared_conversation_id | Shared conversation identifier (CONVERSATION_SHARE / view). | keyword |
+| openai_chatgpt_enterprise.audit_log.action_data.shared_to.capabilities | Capabilities granted to the recipient segment. | keyword |
+| openai_chatgpt_enterprise.audit_log.action_data.shared_to.group_id | Group ID recipient (sharing). | keyword |
+| openai_chatgpt_enterprise.audit_log.action_data.shared_to.recipient_type | Recipient type (UPDATE_SHARING). | keyword |
+| openai_chatgpt_enterprise.audit_log.action_data.shared_to.type | Recipient segment type (CHANGE_VISIBILITY). | keyword |
+| openai_chatgpt_enterprise.audit_log.action_data.sign_in_endpoint | SAML sign-in endpoint URL / SCIM connection identifier. | keyword |
+| openai_chatgpt_enterprise.audit_log.action_data.since_timestamp | Lower-bound timestamp filter (list actions). | date |
+| openai_chatgpt_enterprise.audit_log.action_data.skill_id | Skill identifier. | keyword |
+| openai_chatgpt_enterprise.audit_log.action_data.skill_name | Skill name. | keyword |
+| openai_chatgpt_enterprise.audit_log.action_data.source_surface | Admin surface that initiated the action (admin_apps or admin_plugins). | keyword |
+| openai_chatgpt_enterprise.audit_log.action_data.state_changed | Whether the successful request performed the initial revoke transition. | boolean |
+| openai_chatgpt_enterprise.audit_log.action_data.system_instruction | Workspace default system prompt (WORKSPACE_SET_SYSTEM_INSTRUCTION). | keyword |
+| openai_chatgpt_enterprise.audit_log.action_data.task_id | Codex task identifier. | keyword |
+| openai_chatgpt_enterprise.audit_log.action_data.textdoc_id | Canvas text document identifier. | keyword |
+| openai_chatgpt_enterprise.audit_log.action_data.third_party_gizmo_id | Third-party GPT identifier. | keyword |
+| openai_chatgpt_enterprise.audit_log.action_data.total_requested | Count of join requests approved (INVITE_ACCEPT_ALL). | long |
+| openai_chatgpt_enterprise.audit_log.action_data.use_workspace_name_for_discovery | Whether the workspace name is reused for discovery. | boolean |
+| openai_chatgpt_enterprise.audit_log.action_data.user_id | Auth user ID targeted by the action. | keyword |
+| openai_chatgpt_enterprise.audit_log.action_data.value | Generic value payload (boolean/string) for toggle/set actions. | keyword |
+| openai_chatgpt_enterprise.audit_log.action_data.value_bool | Boolean form of action_data.value (populated when the changed value is a boolean). | boolean |
+| openai_chatgpt_enterprise.audit_log.action_data.workspace_access_state | Skill workspace access state: restricted / discoverable / enabled. | keyword |
+| openai_chatgpt_enterprise.audit_log.action_data.workspace_id | Workspace identifier. | keyword |
+| openai_chatgpt_enterprise.audit_log.action_data.workspace_policy | Workspace policy document or identifier (WORKSPACE_SET_POLICY). | keyword |
+| openai_chatgpt_enterprise.audit_log.action_privilege | Privilege level for the action: ADMIN or STANDARD_USER. | keyword |
+| openai_chatgpt_enterprise.audit_log.action_result | Outcome of the action: SUCCESS, BLOCKED, or ERROR. | keyword |
+| openai_chatgpt_enterprise.audit_log.actor.redacted_id | Redacted identifier of the API key (present when actor.type = API_KEY). | keyword |
+| openai_chatgpt_enterprise.audit_log.actor.type | Type of actor that performed the action (e.g. ACCOUNT_USER, API_KEY). | keyword |
+| openai_chatgpt_enterprise.audit_log.app_id | Identifier of the connected app / connector. | keyword |
+| openai_chatgpt_enterprise.audit_log.client_id | Codex client identifier associated with the event. | keyword |
+| openai_chatgpt_enterprise.audit_log.event_details.detail_type | Discriminator identifying the specific Codex event-details schema. | keyword |
+| openai_chatgpt_enterprise.audit_log.principal.type | Principal that owns the event (e.g. CHATGPT_WORKSPACE). | keyword |
+| openai_chatgpt_enterprise.audit_log.request_metadata.client_ip_details.asn | Autonomous System Number resolved from the client IP. | keyword |
+| openai_chatgpt_enterprise.audit_log.request_metadata.client_ip_details.city | City resolved from the client IP. | keyword |
+| openai_chatgpt_enterprise.audit_log.request_metadata.client_ip_details.country | Country resolved from the client IP. | keyword |
+| openai_chatgpt_enterprise.audit_log.request_metadata.client_ip_details.latitude | Latitude resolved from the client IP. | keyword |
+| openai_chatgpt_enterprise.audit_log.request_metadata.client_ip_details.longitude | Longitude resolved from the client IP. | keyword |
+| openai_chatgpt_enterprise.audit_log.request_metadata.client_ip_details.region | Region / state resolved from the client IP. | keyword |
+| openai_chatgpt_enterprise.audit_log.request_metadata.client_ip_details.region_code | Region / state code resolved from the client IP. | keyword |
+| openai_chatgpt_enterprise.audit_log.request_metadata.client_ja4 | JA4 TLS fingerprint of the client (may be empty). | keyword |
+| openai_chatgpt_enterprise.audit_log.type | Top-level event category (APP_LOG, APP_AUTH_LOG, AUDIT_LOG, AUTH_LOG, CODEX_LOG, CODEX_SECURITY_LOG). | keyword |
+| openai_chatgpt_enterprise.audit_log.workspace_id | Workspace identifier associated with the event. | keyword |
+
+
+### Example event
+
+An example event for `audit_log` looks as following:
+
+```json
+{
+ "@timestamp": "2026-07-09T11:05:09.077Z",
+ "agent": {
+ "ephemeral_id": "d4290824-0b37-43b5-b718-bd38f7ba6230",
+ "id": "ad657795-fbcc-4049-a6ac-d65abc851b66",
+ "name": "elastic-agent-57701",
+ "type": "filebeat",
+ "version": "8.19.0"
+ },
+ "data_stream": {
+ "dataset": "openai_chatgpt_enterprise.audit_log",
+ "namespace": "43110",
+ "type": "logs"
+ },
+ "destination": {
+ "domain": "api.chatgpt.com"
+ },
+ "ecs": {
+ "version": "9.4.0"
+ },
+ "elastic_agent": {
+ "id": "ad657795-fbcc-4049-a6ac-d65abc851b66",
+ "snapshot": false,
+ "version": "8.19.0"
+ },
+ "event": {
+ "action": "list_workspace_log_files",
+ "agent_id_status": "verified",
+ "category": [
+ "iam"
+ ],
+ "dataset": "openai_chatgpt_enterprise.audit_log",
+ "id": "92b7dea7-9ff4-485e-b0a0-74efa627f15b",
+ "ingested": "2026-07-19T18:48:30Z",
+ "kind": "event",
+ "original": "{\"event_id\":\"92b7dea7-9ff4-485e-b0a0-74efa627f15b\",\"type\":\"AUDIT_LOG\",\"principal\":{\"id\":\"be545252-ad04-4cfa-9ca5-deca58416151\",\"type\":\"CHATGPT_WORKSPACE\"},\"actor\":{\"type\":\"API_KEY\",\"redacted_id\":\"sk-...RxIA\"},\"timestamp\":\"2026-07-09T11:05:09.077133Z\",\"action_result\":\"SUCCESS\",\"action_privilege\":\"ADMIN\",\"request_metadata\":{\"client_ip\":\"81.2.69.142\",\"client_ip_details\":{\"country\":\"GB\",\"city\":\"London\",\"region\":\"England\",\"region_code\":\"ENG\",\"asn\":\"\",\"latitude\":\"51.50853\",\"longitude\":\"-0.12574\"},\"client_user_agent\":\"python-requests/2.34.2\",\"client_ja3\":\"86dab2109182b6bbaa644647d7db2997\",\"client_ja4\":\"t13d1713h1_ab0a1bf427ad_8537cf56674e\",\"destination_hostname\":\"api.chatgpt.com\"},\"action_data\":{\"limit\":\"100\",\"after\":\"2026-07-09T10:24:53.814285Z\",\"event_type\":\"AUDIT_LOG\"},\"action\":\"LIST_WORKSPACE_LOG_FILES\"}",
+ "outcome": "success",
+ "type": [
+ "info"
+ ]
+ },
+ "gen_ai": {
+ "system": "openai"
+ },
+ "input": {
+ "type": "cel"
+ },
+ "openai_chatgpt_enterprise": {
+ "audit_log": {
+ "action_data": {
+ "after": "2026-07-09T10:24:53.814Z",
+ "event_type": "AUDIT_LOG",
+ "limit": 100
+ },
+ "action_privilege": "ADMIN",
+ "action_result": "SUCCESS",
+ "actor": {
+ "redacted_id": "sk-...RxIA",
+ "type": "API_KEY"
+ },
+ "principal": {
+ "type": "CHATGPT_WORKSPACE"
+ },
+ "request_metadata": {
+ "client_ip_details": {
+ "city": "London",
+ "country": "GB",
+ "latitude": "51.50853",
+ "longitude": "-0.12574",
+ "region": "England",
+ "region_code": "ENG"
+ },
+ "client_ja4": "t13d1713h1_ab0a1bf427ad_8537cf56674e"
+ },
+ "type": "AUDIT_LOG"
+ }
+ },
+ "organization": {
+ "id": "be545252-ad04-4cfa-9ca5-deca58416151"
+ },
+ "related": {
+ "ip": [
+ "81.2.69.142"
+ ]
+ },
+ "source": {
+ "geo": {
+ "city_name": "London",
+ "continent_name": "Europe",
+ "country_iso_code": "GB",
+ "country_name": "United Kingdom",
+ "location": {
+ "lat": 51.5142,
+ "lon": -0.0931
+ },
+ "region_iso_code": "GB-ENG",
+ "region_name": "England"
+ },
+ "ip": "81.2.69.142"
+ },
+ "tags": [
+ "preserve_original_event",
+ "forwarded",
+ "openai_chatgpt_enterprise-audit_log"
+ ],
+ "tls": {
+ "client": {
+ "ja3": "86dab2109182b6bbaa644647d7db2997"
+ }
+ },
+ "user_agent": {
+ "device": {
+ "name": "Other"
+ },
+ "name": "Python Requests",
+ "original": "python-requests/2.34.2",
+ "version": "2.34"
+ }
+}
+```
+
+### Inputs used
+
+These inputs can be used with this integration:
+
+cel
+
+## Setup
+
+For more details about the CEL input settings, check the [Filebeat documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-cel.html).
+
+Before configuring the CEL input, make sure you have:
+- Network connectivity to the target API endpoint
+- Valid authentication credentials (API keys, tokens, or certificates as required)
+- Appropriate permissions to read from the target data source
+
+### Collecting logs from CEL
+
+To configure the CEL input, you must specify the `request.url` value pointing to the API endpoint. The interval parameter controls how frequently requests are made and is the primary way to balance data freshness with API rate limits and costs. Authentication is often configured through the `request.headers` section using the appropriate method for the service.
+
+NOTE: To access the API service, make sure you have the necessary API credentials and that the Filebeat instance can reach the endpoint URL. Some services may require IP whitelisting or VPN access.
+
+To collect logs via API endpoint, configure the following parameters:
+
+- API Endpoint URL
+- API credentials (tokens, keys, or username/password)
+- Request interval (how often to fetch data)
+
+
+
+### API usage
+
+These APIs are used with this integration:
+
+* List compliance log files (endpoint: `GET /v1/compliance/workspaces/{workspace_id}/logs` or `GET /v1/compliance/organizations/{organization_id}/logs`)
+* Download a compliance log file (endpoint: `GET /v1/compliance/workspaces/{workspace_id}/logs/{log_file_id}` or `GET /v1/compliance/organizations/{organization_id}/logs/{log_file_id}`)
diff --git a/packages/openai_chatgpt_enterprise/img/audit-log-dashboard.png b/packages/openai_chatgpt_enterprise/img/audit-log-dashboard.png
new file mode 100644
index 00000000000..f41539b49d8
Binary files /dev/null and b/packages/openai_chatgpt_enterprise/img/audit-log-dashboard.png differ
diff --git a/packages/openai_chatgpt_enterprise/img/openai-logo.svg b/packages/openai_chatgpt_enterprise/img/openai-logo.svg
new file mode 100644
index 00000000000..3c455da207b
--- /dev/null
+++ b/packages/openai_chatgpt_enterprise/img/openai-logo.svg
@@ -0,0 +1,10 @@
+
+
diff --git a/packages/openai_chatgpt_enterprise/kibana/dashboard/openai_chatgpt_enterprise-7c1f2a3b-4d5e-4f60-8a71-2b3c4d5e6f01.json b/packages/openai_chatgpt_enterprise/kibana/dashboard/openai_chatgpt_enterprise-7c1f2a3b-4d5e-4f60-8a71-2b3c4d5e6f01.json
new file mode 100644
index 00000000000..d7743e69075
--- /dev/null
+++ b/packages/openai_chatgpt_enterprise/kibana/dashboard/openai_chatgpt_enterprise-7c1f2a3b-4d5e-4f60-8a71-2b3c4d5e6f01.json
@@ -0,0 +1,1728 @@
+{
+ "attributes": {
+ "controlGroupInput": {
+ "chainingSystem": "HIERARCHICAL",
+ "controlStyle": "oneLine",
+ "ignoreParentSettingsJSON": {
+ "ignoreFilters": false,
+ "ignoreQuery": false,
+ "ignoreTimerange": false,
+ "ignoreValidations": false
+ },
+ "panelsJSON": {
+ "1a000000-0000-4000-8000-000000000001": {
+ "explicitInput": {
+ "dataViewId": "logs-*",
+ "exclude": false,
+ "existsSelected": false,
+ "fieldName": "event.action",
+ "searchTechnique": "prefix",
+ "selectedOptions": [],
+ "sort": {
+ "by": "_count",
+ "direction": "desc"
+ },
+ "title": "Event Action"
+ },
+ "grow": true,
+ "order": 0,
+ "type": "optionsListControl",
+ "width": "medium"
+ },
+ "1a000000-0000-4000-8000-000000000002": {
+ "explicitInput": {
+ "dataViewId": "logs-*",
+ "exclude": false,
+ "existsSelected": false,
+ "fieldName": "user.email",
+ "searchTechnique": "prefix",
+ "selectedOptions": [],
+ "sort": {
+ "by": "_count",
+ "direction": "desc"
+ },
+ "title": "User Email"
+ },
+ "grow": true,
+ "order": 1,
+ "type": "optionsListControl",
+ "width": "medium"
+ },
+ "1a000000-0000-4000-8000-000000000003": {
+ "explicitInput": {
+ "dataViewId": "logs-*",
+ "exclude": false,
+ "existsSelected": false,
+ "fieldName": "openai_chatgpt_enterprise.audit_log.actor.type",
+ "searchTechnique": "prefix",
+ "selectedOptions": [],
+ "sort": {
+ "by": "_count",
+ "direction": "desc"
+ },
+ "title": "Actor Type"
+ },
+ "grow": true,
+ "order": 2,
+ "type": "optionsListControl",
+ "width": "medium"
+ }
+ },
+ "showApplySelections": false
+ },
+ "description": "",
+ "kibanaSavedObjectMeta": {
+ "searchSourceJSON": {
+ "filter": [
+ {
+ "$state": {
+ "store": "appState"
+ },
+ "meta": {
+ "alias": null,
+ "disabled": false,
+ "field": "data_stream.dataset",
+ "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index",
+ "key": "data_stream.dataset",
+ "negate": false,
+ "params": {
+ "query": "openai_chatgpt_enterprise.audit_log"
+ },
+ "type": "phrase"
+ },
+ "query": {
+ "match_phrase": {
+ "data_stream.dataset": "openai_chatgpt_enterprise.audit_log"
+ }
+ }
+ }
+ ],
+ "query": {
+ "language": "kuery",
+ "query": ""
+ }
+ }
+ },
+ "optionsJSON": {
+ "hidePanelTitles": false,
+ "syncColors": false,
+ "syncCursor": true,
+ "syncTooltips": false,
+ "useMargins": true
+ },
+ "panelsJSON": [
+ {
+ "embeddableConfig": {
+ "enhancements": {},
+ "savedVis": {
+ "data": {
+ "aggs": [],
+ "searchSource": {
+ "filter": [],
+ "query": {
+ "language": "kuery",
+ "query": ""
+ }
+ }
+ },
+ "description": "",
+ "params": {
+ "fontSize": 12,
+ "markdown": "#### OpenAI ChatGPT Enterprise\n\n**Audit Logs**\n\nThis dashboard gives visibility into the audit_log data stream of OpenAI ChatGPT Enterprise, showing how administrative and workspace actions are recorded and monitored. It highlights total audit events and unique users, trends of audit events by action over time, and breakdowns by outcome, privilege, and actor type. It surfaces top actions, top users, top source IPs, top source countries, and top user agents. Use the controls above to filter by action, user, and actor type. Together, these panels offer an audit-level view to support security oversight, auditing, and usage analysis.\n\n**[Integration Page](/app/integrations/detail/openai_chatgpt_enterprise/overview)**\n",
+ "openLinksInNewTab": false
+ },
+ "title": "",
+ "type": "markdown",
+ "uiState": {}
+ },
+ "title": ""
+ },
+ "gridData": {
+ "h": 26,
+ "i": "2a000000-0000-4000-8000-000000000001",
+ "w": 12,
+ "x": 0,
+ "y": 0
+ },
+ "panelIndex": "2a000000-0000-4000-8000-000000000001",
+ "type": "visualization"
+ },
+ {
+ "embeddableConfig": {
+ "attributes": {
+ "references": [
+ {
+ "id": "logs-*",
+ "name": "indexpattern-datasource-layer-3a000000-0000-4000-8000-000000000010",
+ "type": "index-pattern"
+ }
+ ],
+ "state": {
+ "adHocDataViews": {},
+ "datasourceStates": {
+ "formBased": {
+ "layers": {
+ "3a000000-0000-4000-8000-000000000010": {
+ "columnOrder": [
+ "4a000000-0000-4000-8000-000000000010"
+ ],
+ "columns": {
+ "4a000000-0000-4000-8000-000000000010": {
+ "customLabel": true,
+ "dataType": "number",
+ "isBucketed": false,
+ "label": "Total Audit Events",
+ "operationType": "count",
+ "params": {
+ "emptyAsNull": false
+ },
+ "sourceField": "___records___"
+ }
+ },
+ "ignoreGlobalFilters": false,
+ "incompleteColumns": {},
+ "sampling": 1
+ }
+ }
+ },
+ "indexpattern": {
+ "layers": {}
+ },
+ "textBased": {
+ "layers": {}
+ }
+ },
+ "filters": [
+ {
+ "$state": {
+ "store": "appState"
+ },
+ "meta": {
+ "alias": null,
+ "disabled": false,
+ "field": "data_stream.dataset",
+ "index": "logs-*",
+ "key": "data_stream.dataset",
+ "negate": false,
+ "params": {
+ "query": "openai_chatgpt_enterprise.audit_log"
+ },
+ "type": "phrase"
+ },
+ "query": {
+ "match_phrase": {
+ "data_stream.dataset": "openai_chatgpt_enterprise.audit_log"
+ }
+ }
+ }
+ ],
+ "internalReferences": [],
+ "query": {
+ "language": "kuery",
+ "query": ""
+ },
+ "visualization": {
+ "color": "#6092C0",
+ "layerId": "3a000000-0000-4000-8000-000000000010",
+ "layerType": "data",
+ "metricAccessor": "4a000000-0000-4000-8000-000000000010",
+ "showBar": false
+ }
+ },
+ "title": "",
+ "type": "lens",
+ "visualizationType": "lnsMetric"
+ },
+ "enhancements": {},
+ "filters": [],
+ "hidePanelTitles": true,
+ "query": {
+ "language": "kuery",
+ "query": ""
+ },
+ "title": "Total Audit Events"
+ },
+ "gridData": {
+ "h": 11,
+ "i": "2a000000-0000-4000-8000-000000000010",
+ "w": 18,
+ "x": 12,
+ "y": 0
+ },
+ "panelIndex": "2a000000-0000-4000-8000-000000000010",
+ "type": "lens"
+ },
+ {
+ "embeddableConfig": {
+ "attributes": {
+ "references": [
+ {
+ "id": "logs-*",
+ "name": "indexpattern-datasource-layer-3a000000-0000-4000-8000-000000000011",
+ "type": "index-pattern"
+ }
+ ],
+ "state": {
+ "adHocDataViews": {},
+ "datasourceStates": {
+ "formBased": {
+ "layers": {
+ "3a000000-0000-4000-8000-000000000011": {
+ "columnOrder": [
+ "4a000000-0000-4000-8000-000000000011"
+ ],
+ "columns": {
+ "4a000000-0000-4000-8000-000000000011": {
+ "customLabel": true,
+ "dataType": "number",
+ "isBucketed": false,
+ "label": "Unique Users",
+ "operationType": "unique_count",
+ "params": {
+ "emptyAsNull": false
+ },
+ "sourceField": "user.id"
+ }
+ },
+ "ignoreGlobalFilters": false,
+ "incompleteColumns": {},
+ "sampling": 1
+ }
+ }
+ },
+ "indexpattern": {
+ "layers": {}
+ },
+ "textBased": {
+ "layers": {}
+ }
+ },
+ "filters": [
+ {
+ "$state": {
+ "store": "appState"
+ },
+ "meta": {
+ "alias": null,
+ "disabled": false,
+ "field": "data_stream.dataset",
+ "index": "logs-*",
+ "key": "data_stream.dataset",
+ "negate": false,
+ "params": {
+ "query": "openai_chatgpt_enterprise.audit_log"
+ },
+ "type": "phrase"
+ },
+ "query": {
+ "match_phrase": {
+ "data_stream.dataset": "openai_chatgpt_enterprise.audit_log"
+ }
+ }
+ }
+ ],
+ "internalReferences": [],
+ "query": {
+ "language": "kuery",
+ "query": ""
+ },
+ "visualization": {
+ "color": "#6092C0",
+ "layerId": "3a000000-0000-4000-8000-000000000011",
+ "layerType": "data",
+ "metricAccessor": "4a000000-0000-4000-8000-000000000011",
+ "showBar": false
+ }
+ },
+ "title": "",
+ "type": "lens",
+ "visualizationType": "lnsMetric"
+ },
+ "enhancements": {},
+ "filters": [],
+ "hidePanelTitles": true,
+ "query": {
+ "language": "kuery",
+ "query": ""
+ },
+ "title": "Unique Users"
+ },
+ "gridData": {
+ "h": 11,
+ "i": "2a000000-0000-4000-8000-000000000011",
+ "w": 18,
+ "x": 30,
+ "y": 0
+ },
+ "panelIndex": "2a000000-0000-4000-8000-000000000011",
+ "type": "lens"
+ },
+ {
+ "embeddableConfig": {
+ "attributes": {
+ "references": [
+ {
+ "id": "logs-*",
+ "name": "indexpattern-datasource-layer-3a000000-0000-4000-8000-000000000012",
+ "type": "index-pattern"
+ }
+ ],
+ "state": {
+ "adHocDataViews": {},
+ "datasourceStates": {
+ "formBased": {
+ "layers": {
+ "3a000000-0000-4000-8000-000000000012": {
+ "columnOrder": [
+ "4a000000-0000-4000-8000-000000000121",
+ "4a000000-0000-4000-8000-000000000123",
+ "4a000000-0000-4000-8000-000000000122"
+ ],
+ "columns": {
+ "4a000000-0000-4000-8000-000000000121": {
+ "dataType": "date",
+ "isBucketed": true,
+ "label": "@timestamp",
+ "operationType": "date_histogram",
+ "params": {
+ "dropPartials": false,
+ "includeEmptyRows": true,
+ "interval": "auto"
+ },
+ "sourceField": "@timestamp"
+ },
+ "4a000000-0000-4000-8000-000000000122": {
+ "customLabel": true,
+ "dataType": "number",
+ "isBucketed": false,
+ "label": "Count",
+ "operationType": "count",
+ "params": {
+ "emptyAsNull": false
+ },
+ "sourceField": "___records___"
+ },
+ "4a000000-0000-4000-8000-000000000123": {
+ "customLabel": true,
+ "dataType": "string",
+ "isBucketed": true,
+ "label": "Action",
+ "operationType": "terms",
+ "params": {
+ "missingBucket": false,
+ "orderBy": {
+ "columnId": "4a000000-0000-4000-8000-000000000122",
+ "type": "column"
+ },
+ "orderDirection": "desc",
+ "otherBucket": true,
+ "parentFormat": {
+ "id": "terms"
+ },
+ "size": 10
+ },
+ "sourceField": "event.action"
+ }
+ },
+ "ignoreGlobalFilters": false,
+ "incompleteColumns": {},
+ "sampling": 1
+ }
+ }
+ },
+ "indexpattern": {
+ "layers": {}
+ },
+ "textBased": {
+ "layers": {}
+ }
+ },
+ "filters": [
+ {
+ "$state": {
+ "store": "appState"
+ },
+ "meta": {
+ "alias": null,
+ "disabled": false,
+ "field": "data_stream.dataset",
+ "index": "logs-*",
+ "key": "data_stream.dataset",
+ "negate": false,
+ "params": {
+ "query": "openai_chatgpt_enterprise.audit_log"
+ },
+ "type": "phrase"
+ },
+ "query": {
+ "match_phrase": {
+ "data_stream.dataset": "openai_chatgpt_enterprise.audit_log"
+ }
+ }
+ }
+ ],
+ "internalReferences": [],
+ "query": {
+ "language": "kuery",
+ "query": ""
+ },
+ "visualization": {
+ "layers": [
+ {
+ "accessors": [
+ "4a000000-0000-4000-8000-000000000122"
+ ],
+ "layerId": "3a000000-0000-4000-8000-000000000012",
+ "layerType": "data",
+ "seriesType": "line",
+ "splitAccessor": "4a000000-0000-4000-8000-000000000123",
+ "xAccessor": "4a000000-0000-4000-8000-000000000121"
+ }
+ ],
+ "legend": {
+ "isVisible": true,
+ "position": "right",
+ "shouldTruncate": false
+ },
+ "preferredSeriesType": "line",
+ "valueLabels": "hide"
+ }
+ },
+ "title": "",
+ "type": "lens",
+ "visualizationType": "lnsXY"
+ },
+ "enhancements": {},
+ "filters": [],
+ "query": {
+ "language": "kuery",
+ "query": ""
+ },
+ "title": "Audit Events Over Time by Action"
+ },
+ "gridData": {
+ "h": 15,
+ "i": "2a000000-0000-4000-8000-000000000012",
+ "w": 36,
+ "x": 12,
+ "y": 11
+ },
+ "panelIndex": "2a000000-0000-4000-8000-000000000012",
+ "type": "lens"
+ },
+ {
+ "embeddableConfig": {
+ "attributes": {
+ "references": [
+ {
+ "id": "logs-*",
+ "name": "indexpattern-datasource-layer-3a000000-0000-4000-8000-000000000013",
+ "type": "index-pattern"
+ }
+ ],
+ "state": {
+ "adHocDataViews": {},
+ "datasourceStates": {
+ "formBased": {
+ "layers": {
+ "3a000000-0000-4000-8000-000000000013": {
+ "columnOrder": [
+ "4a000000-0000-4000-8000-000000000131",
+ "4a000000-0000-4000-8000-000000000132"
+ ],
+ "columns": {
+ "4a000000-0000-4000-8000-000000000131": {
+ "customLabel": true,
+ "dataType": "string",
+ "isBucketed": true,
+ "label": "Top Actions",
+ "operationType": "terms",
+ "params": {
+ "missingBucket": false,
+ "orderBy": {
+ "columnId": "4a000000-0000-4000-8000-000000000132",
+ "type": "column"
+ },
+ "orderDirection": "desc",
+ "otherBucket": true,
+ "parentFormat": {
+ "id": "terms"
+ },
+ "size": 10
+ },
+ "sourceField": "event.action"
+ },
+ "4a000000-0000-4000-8000-000000000132": {
+ "customLabel": true,
+ "dataType": "number",
+ "isBucketed": false,
+ "label": "Count",
+ "operationType": "count",
+ "params": {
+ "emptyAsNull": false
+ },
+ "sourceField": "___records___"
+ }
+ },
+ "ignoreGlobalFilters": false,
+ "incompleteColumns": {},
+ "sampling": 1
+ }
+ }
+ },
+ "indexpattern": {
+ "layers": {}
+ },
+ "textBased": {
+ "layers": {}
+ }
+ },
+ "filters": [
+ {
+ "$state": {
+ "store": "appState"
+ },
+ "meta": {
+ "alias": null,
+ "disabled": false,
+ "field": "data_stream.dataset",
+ "index": "logs-*",
+ "key": "data_stream.dataset",
+ "negate": false,
+ "params": {
+ "query": "openai_chatgpt_enterprise.audit_log"
+ },
+ "type": "phrase"
+ },
+ "query": {
+ "match_phrase": {
+ "data_stream.dataset": "openai_chatgpt_enterprise.audit_log"
+ }
+ }
+ }
+ ],
+ "internalReferences": [],
+ "query": {
+ "language": "kuery",
+ "query": ""
+ },
+ "visualization": {
+ "layers": [
+ {
+ "accessors": [
+ "4a000000-0000-4000-8000-000000000132"
+ ],
+ "layerId": "3a000000-0000-4000-8000-000000000013",
+ "layerType": "data",
+ "seriesType": "bar_horizontal",
+ "xAccessor": "4a000000-0000-4000-8000-000000000131"
+ }
+ ],
+ "legend": {
+ "isVisible": true,
+ "position": "right",
+ "shouldTruncate": false
+ },
+ "preferredSeriesType": "bar_horizontal",
+ "valueLabels": "hide"
+ }
+ },
+ "title": "",
+ "type": "lens",
+ "visualizationType": "lnsXY"
+ },
+ "enhancements": {},
+ "filters": [],
+ "query": {
+ "language": "kuery",
+ "query": ""
+ },
+ "title": "Top Actions"
+ },
+ "gridData": {
+ "h": 15,
+ "i": "2a000000-0000-4000-8000-000000000013",
+ "w": 24,
+ "x": 0,
+ "y": 26
+ },
+ "panelIndex": "2a000000-0000-4000-8000-000000000013",
+ "type": "lens"
+ },
+ {
+ "embeddableConfig": {
+ "attributes": {
+ "references": [
+ {
+ "id": "logs-*",
+ "name": "indexpattern-datasource-layer-3a000000-0000-4000-8000-000000000014",
+ "type": "index-pattern"
+ }
+ ],
+ "state": {
+ "adHocDataViews": {},
+ "datasourceStates": {
+ "formBased": {
+ "layers": {
+ "3a000000-0000-4000-8000-000000000014": {
+ "columnOrder": [
+ "4a000000-0000-4000-8000-000000000141",
+ "4a000000-0000-4000-8000-000000000142"
+ ],
+ "columns": {
+ "4a000000-0000-4000-8000-000000000141": {
+ "customLabel": true,
+ "dataType": "string",
+ "isBucketed": true,
+ "label": "Outcome",
+ "operationType": "terms",
+ "params": {
+ "missingBucket": false,
+ "orderBy": {
+ "columnId": "4a000000-0000-4000-8000-000000000142",
+ "type": "column"
+ },
+ "orderDirection": "desc",
+ "otherBucket": false,
+ "parentFormat": {
+ "id": "terms"
+ },
+ "size": 5
+ },
+ "sourceField": "event.outcome"
+ },
+ "4a000000-0000-4000-8000-000000000142": {
+ "dataType": "number",
+ "isBucketed": false,
+ "label": "Count",
+ "operationType": "count",
+ "params": {
+ "emptyAsNull": false
+ },
+ "sourceField": "___records___"
+ }
+ },
+ "ignoreGlobalFilters": false,
+ "incompleteColumns": {},
+ "sampling": 1
+ }
+ }
+ },
+ "indexpattern": {
+ "layers": {}
+ },
+ "textBased": {
+ "layers": {}
+ }
+ },
+ "filters": [
+ {
+ "$state": {
+ "store": "appState"
+ },
+ "meta": {
+ "alias": null,
+ "disabled": false,
+ "field": "data_stream.dataset",
+ "index": "logs-*",
+ "key": "data_stream.dataset",
+ "negate": false,
+ "params": {
+ "query": "openai_chatgpt_enterprise.audit_log"
+ },
+ "type": "phrase"
+ },
+ "query": {
+ "match_phrase": {
+ "data_stream.dataset": "openai_chatgpt_enterprise.audit_log"
+ }
+ }
+ }
+ ],
+ "internalReferences": [],
+ "query": {
+ "language": "kuery",
+ "query": ""
+ },
+ "visualization": {
+ "layers": [
+ {
+ "categoryDisplay": "default",
+ "layerId": "3a000000-0000-4000-8000-000000000014",
+ "layerType": "data",
+ "legendDisplay": "show",
+ "metrics": [
+ "4a000000-0000-4000-8000-000000000142"
+ ],
+ "nestedLegend": false,
+ "numberDisplay": "percent",
+ "primaryGroups": [
+ "4a000000-0000-4000-8000-000000000141"
+ ],
+ "truncateLegend": false
+ }
+ ],
+ "shape": "pie"
+ }
+ },
+ "title": "",
+ "type": "lens",
+ "visualizationType": "lnsPie"
+ },
+ "enhancements": {},
+ "filters": [],
+ "query": {
+ "language": "kuery",
+ "query": ""
+ },
+ "title": "Action Outcome"
+ },
+ "gridData": {
+ "h": 15,
+ "i": "2a000000-0000-4000-8000-000000000014",
+ "w": 12,
+ "x": 24,
+ "y": 26
+ },
+ "panelIndex": "2a000000-0000-4000-8000-000000000014",
+ "type": "lens"
+ },
+ {
+ "embeddableConfig": {
+ "attributes": {
+ "references": [
+ {
+ "id": "logs-*",
+ "name": "indexpattern-datasource-layer-3a000000-0000-4000-8000-000000000015",
+ "type": "index-pattern"
+ }
+ ],
+ "state": {
+ "adHocDataViews": {},
+ "datasourceStates": {
+ "formBased": {
+ "layers": {
+ "3a000000-0000-4000-8000-000000000015": {
+ "columnOrder": [
+ "4a000000-0000-4000-8000-000000000151",
+ "4a000000-0000-4000-8000-000000000152"
+ ],
+ "columns": {
+ "4a000000-0000-4000-8000-000000000151": {
+ "customLabel": true,
+ "dataType": "string",
+ "isBucketed": true,
+ "label": "Privilege",
+ "operationType": "terms",
+ "params": {
+ "missingBucket": false,
+ "orderBy": {
+ "columnId": "4a000000-0000-4000-8000-000000000152",
+ "type": "column"
+ },
+ "orderDirection": "desc",
+ "otherBucket": false,
+ "parentFormat": {
+ "id": "terms"
+ },
+ "size": 5
+ },
+ "sourceField": "openai_chatgpt_enterprise.audit_log.action_privilege"
+ },
+ "4a000000-0000-4000-8000-000000000152": {
+ "dataType": "number",
+ "isBucketed": false,
+ "label": "Count",
+ "operationType": "count",
+ "params": {
+ "emptyAsNull": false
+ },
+ "sourceField": "___records___"
+ }
+ },
+ "ignoreGlobalFilters": false,
+ "incompleteColumns": {},
+ "sampling": 1
+ }
+ }
+ },
+ "indexpattern": {
+ "layers": {}
+ },
+ "textBased": {
+ "layers": {}
+ }
+ },
+ "filters": [
+ {
+ "$state": {
+ "store": "appState"
+ },
+ "meta": {
+ "alias": null,
+ "disabled": false,
+ "field": "data_stream.dataset",
+ "index": "logs-*",
+ "key": "data_stream.dataset",
+ "negate": false,
+ "params": {
+ "query": "openai_chatgpt_enterprise.audit_log"
+ },
+ "type": "phrase"
+ },
+ "query": {
+ "match_phrase": {
+ "data_stream.dataset": "openai_chatgpt_enterprise.audit_log"
+ }
+ }
+ }
+ ],
+ "internalReferences": [],
+ "query": {
+ "language": "kuery",
+ "query": ""
+ },
+ "visualization": {
+ "layers": [
+ {
+ "categoryDisplay": "default",
+ "layerId": "3a000000-0000-4000-8000-000000000015",
+ "layerType": "data",
+ "legendDisplay": "show",
+ "metrics": [
+ "4a000000-0000-4000-8000-000000000152"
+ ],
+ "nestedLegend": false,
+ "numberDisplay": "percent",
+ "primaryGroups": [
+ "4a000000-0000-4000-8000-000000000151"
+ ],
+ "truncateLegend": false
+ }
+ ],
+ "shape": "pie"
+ }
+ },
+ "title": "",
+ "type": "lens",
+ "visualizationType": "lnsPie"
+ },
+ "enhancements": {},
+ "filters": [],
+ "query": {
+ "language": "kuery",
+ "query": ""
+ },
+ "title": "Action Privilege"
+ },
+ "gridData": {
+ "h": 15,
+ "i": "2a000000-0000-4000-8000-000000000015",
+ "w": 12,
+ "x": 36,
+ "y": 26
+ },
+ "panelIndex": "2a000000-0000-4000-8000-000000000015",
+ "type": "lens"
+ },
+ {
+ "embeddableConfig": {
+ "attributes": {
+ "references": [
+ {
+ "id": "logs-*",
+ "name": "indexpattern-datasource-layer-3a000000-0000-4000-8000-000000000016",
+ "type": "index-pattern"
+ }
+ ],
+ "state": {
+ "adHocDataViews": {},
+ "datasourceStates": {
+ "formBased": {
+ "layers": {
+ "3a000000-0000-4000-8000-000000000016": {
+ "columnOrder": [
+ "4a000000-0000-4000-8000-000000000161",
+ "4a000000-0000-4000-8000-000000000162"
+ ],
+ "columns": {
+ "4a000000-0000-4000-8000-000000000161": {
+ "customLabel": true,
+ "dataType": "string",
+ "isBucketed": true,
+ "label": "Actor Type",
+ "operationType": "terms",
+ "params": {
+ "missingBucket": false,
+ "orderBy": {
+ "columnId": "4a000000-0000-4000-8000-000000000162",
+ "type": "column"
+ },
+ "orderDirection": "desc",
+ "otherBucket": false,
+ "parentFormat": {
+ "id": "terms"
+ },
+ "size": 5
+ },
+ "sourceField": "openai_chatgpt_enterprise.audit_log.actor.type"
+ },
+ "4a000000-0000-4000-8000-000000000162": {
+ "dataType": "number",
+ "isBucketed": false,
+ "label": "Count",
+ "operationType": "count",
+ "params": {
+ "emptyAsNull": false
+ },
+ "sourceField": "___records___"
+ }
+ },
+ "ignoreGlobalFilters": false,
+ "incompleteColumns": {},
+ "sampling": 1
+ }
+ }
+ },
+ "indexpattern": {
+ "layers": {}
+ },
+ "textBased": {
+ "layers": {}
+ }
+ },
+ "filters": [
+ {
+ "$state": {
+ "store": "appState"
+ },
+ "meta": {
+ "alias": null,
+ "disabled": false,
+ "field": "data_stream.dataset",
+ "index": "logs-*",
+ "key": "data_stream.dataset",
+ "negate": false,
+ "params": {
+ "query": "openai_chatgpt_enterprise.audit_log"
+ },
+ "type": "phrase"
+ },
+ "query": {
+ "match_phrase": {
+ "data_stream.dataset": "openai_chatgpt_enterprise.audit_log"
+ }
+ }
+ }
+ ],
+ "internalReferences": [],
+ "query": {
+ "language": "kuery",
+ "query": ""
+ },
+ "visualization": {
+ "layers": [
+ {
+ "categoryDisplay": "default",
+ "layerId": "3a000000-0000-4000-8000-000000000016",
+ "layerType": "data",
+ "legendDisplay": "show",
+ "metrics": [
+ "4a000000-0000-4000-8000-000000000162"
+ ],
+ "nestedLegend": false,
+ "numberDisplay": "percent",
+ "primaryGroups": [
+ "4a000000-0000-4000-8000-000000000161"
+ ],
+ "truncateLegend": false
+ }
+ ],
+ "shape": "pie"
+ }
+ },
+ "title": "",
+ "type": "lens",
+ "visualizationType": "lnsPie"
+ },
+ "enhancements": {},
+ "filters": [],
+ "query": {
+ "language": "kuery",
+ "query": ""
+ },
+ "title": "Actor Type"
+ },
+ "gridData": {
+ "h": 15,
+ "i": "2a000000-0000-4000-8000-000000000016",
+ "w": 12,
+ "x": 0,
+ "y": 41
+ },
+ "panelIndex": "2a000000-0000-4000-8000-000000000016",
+ "type": "lens"
+ },
+ {
+ "embeddableConfig": {
+ "attributes": {
+ "references": [
+ {
+ "id": "logs-*",
+ "name": "indexpattern-datasource-layer-3a000000-0000-4000-8000-000000000017",
+ "type": "index-pattern"
+ }
+ ],
+ "state": {
+ "adHocDataViews": {},
+ "datasourceStates": {
+ "formBased": {
+ "layers": {
+ "3a000000-0000-4000-8000-000000000017": {
+ "columnOrder": [
+ "4a000000-0000-4000-8000-000000000171",
+ "4a000000-0000-4000-8000-000000000172"
+ ],
+ "columns": {
+ "4a000000-0000-4000-8000-000000000171": {
+ "customLabel": true,
+ "dataType": "string",
+ "isBucketed": true,
+ "label": "Top Users",
+ "operationType": "terms",
+ "params": {
+ "missingBucket": false,
+ "orderBy": {
+ "columnId": "4a000000-0000-4000-8000-000000000172",
+ "type": "column"
+ },
+ "orderDirection": "desc",
+ "otherBucket": false,
+ "parentFormat": {
+ "id": "terms"
+ },
+ "size": 10
+ },
+ "sourceField": "user.email"
+ },
+ "4a000000-0000-4000-8000-000000000172": {
+ "customLabel": true,
+ "dataType": "number",
+ "isBucketed": false,
+ "label": "Count",
+ "operationType": "count",
+ "params": {
+ "emptyAsNull": false
+ },
+ "sourceField": "___records___"
+ }
+ },
+ "ignoreGlobalFilters": false,
+ "incompleteColumns": {},
+ "sampling": 1
+ }
+ }
+ },
+ "indexpattern": {
+ "layers": {}
+ },
+ "textBased": {
+ "layers": {}
+ }
+ },
+ "filters": [
+ {
+ "$state": {
+ "store": "appState"
+ },
+ "meta": {
+ "alias": null,
+ "disabled": false,
+ "field": "data_stream.dataset",
+ "index": "logs-*",
+ "key": "data_stream.dataset",
+ "negate": false,
+ "params": {
+ "query": "openai_chatgpt_enterprise.audit_log"
+ },
+ "type": "phrase"
+ },
+ "query": {
+ "match_phrase": {
+ "data_stream.dataset": "openai_chatgpt_enterprise.audit_log"
+ }
+ }
+ }
+ ],
+ "internalReferences": [],
+ "query": {
+ "language": "kuery",
+ "query": ""
+ },
+ "visualization": {
+ "columns": [
+ {
+ "columnId": "4a000000-0000-4000-8000-000000000171",
+ "isMetric": false,
+ "isTransposed": false
+ },
+ {
+ "columnId": "4a000000-0000-4000-8000-000000000172",
+ "isMetric": true,
+ "isTransposed": false
+ }
+ ],
+ "layerId": "3a000000-0000-4000-8000-000000000017",
+ "layerType": "data"
+ }
+ },
+ "title": "",
+ "type": "lens",
+ "visualizationType": "lnsDatatable"
+ },
+ "enhancements": {},
+ "filters": [],
+ "query": {
+ "language": "kuery",
+ "query": ""
+ },
+ "title": "Top Users"
+ },
+ "gridData": {
+ "h": 15,
+ "i": "2a000000-0000-4000-8000-000000000017",
+ "w": 12,
+ "x": 12,
+ "y": 41
+ },
+ "panelIndex": "2a000000-0000-4000-8000-000000000017",
+ "type": "lens"
+ },
+ {
+ "embeddableConfig": {
+ "attributes": {
+ "references": [
+ {
+ "id": "logs-*",
+ "name": "indexpattern-datasource-layer-3a000000-0000-4000-8000-000000000018",
+ "type": "index-pattern"
+ }
+ ],
+ "state": {
+ "adHocDataViews": {},
+ "datasourceStates": {
+ "formBased": {
+ "layers": {
+ "3a000000-0000-4000-8000-000000000018": {
+ "columnOrder": [
+ "4a000000-0000-4000-8000-000000000181",
+ "4a000000-0000-4000-8000-000000000182"
+ ],
+ "columns": {
+ "4a000000-0000-4000-8000-000000000181": {
+ "customLabel": true,
+ "dataType": "ip",
+ "isBucketed": true,
+ "label": "Top Source IPs",
+ "operationType": "terms",
+ "params": {
+ "missingBucket": false,
+ "orderBy": {
+ "columnId": "4a000000-0000-4000-8000-000000000182",
+ "type": "column"
+ },
+ "orderDirection": "desc",
+ "otherBucket": false,
+ "parentFormat": {
+ "id": "terms"
+ },
+ "size": 10
+ },
+ "sourceField": "source.ip"
+ },
+ "4a000000-0000-4000-8000-000000000182": {
+ "customLabel": true,
+ "dataType": "number",
+ "isBucketed": false,
+ "label": "Count",
+ "operationType": "count",
+ "params": {
+ "emptyAsNull": false
+ },
+ "sourceField": "___records___"
+ }
+ },
+ "ignoreGlobalFilters": false,
+ "incompleteColumns": {},
+ "sampling": 1
+ }
+ }
+ },
+ "indexpattern": {
+ "layers": {}
+ },
+ "textBased": {
+ "layers": {}
+ }
+ },
+ "filters": [
+ {
+ "$state": {
+ "store": "appState"
+ },
+ "meta": {
+ "alias": null,
+ "disabled": false,
+ "field": "data_stream.dataset",
+ "index": "logs-*",
+ "key": "data_stream.dataset",
+ "negate": false,
+ "params": {
+ "query": "openai_chatgpt_enterprise.audit_log"
+ },
+ "type": "phrase"
+ },
+ "query": {
+ "match_phrase": {
+ "data_stream.dataset": "openai_chatgpt_enterprise.audit_log"
+ }
+ }
+ }
+ ],
+ "internalReferences": [],
+ "query": {
+ "language": "kuery",
+ "query": ""
+ },
+ "visualization": {
+ "columns": [
+ {
+ "columnId": "4a000000-0000-4000-8000-000000000181",
+ "isMetric": false,
+ "isTransposed": false
+ },
+ {
+ "columnId": "4a000000-0000-4000-8000-000000000182",
+ "isMetric": true,
+ "isTransposed": false
+ }
+ ],
+ "layerId": "3a000000-0000-4000-8000-000000000018",
+ "layerType": "data"
+ }
+ },
+ "title": "",
+ "type": "lens",
+ "visualizationType": "lnsDatatable"
+ },
+ "enhancements": {},
+ "filters": [],
+ "query": {
+ "language": "kuery",
+ "query": ""
+ },
+ "title": "Top Source IPs"
+ },
+ "gridData": {
+ "h": 15,
+ "i": "2a000000-0000-4000-8000-000000000018",
+ "w": 12,
+ "x": 24,
+ "y": 41
+ },
+ "panelIndex": "2a000000-0000-4000-8000-000000000018",
+ "type": "lens"
+ },
+ {
+ "embeddableConfig": {
+ "attributes": {
+ "references": [
+ {
+ "id": "logs-*",
+ "name": "indexpattern-datasource-layer-3a000000-0000-4000-8000-000000000019",
+ "type": "index-pattern"
+ }
+ ],
+ "state": {
+ "adHocDataViews": {},
+ "datasourceStates": {
+ "formBased": {
+ "layers": {
+ "3a000000-0000-4000-8000-000000000019": {
+ "columnOrder": [
+ "4a000000-0000-4000-8000-000000000191",
+ "4a000000-0000-4000-8000-000000000192"
+ ],
+ "columns": {
+ "4a000000-0000-4000-8000-000000000191": {
+ "customLabel": true,
+ "dataType": "string",
+ "isBucketed": true,
+ "label": "Top Source Countries",
+ "operationType": "terms",
+ "params": {
+ "missingBucket": false,
+ "orderBy": {
+ "columnId": "4a000000-0000-4000-8000-000000000192",
+ "type": "column"
+ },
+ "orderDirection": "desc",
+ "otherBucket": false,
+ "parentFormat": {
+ "id": "terms"
+ },
+ "size": 10
+ },
+ "sourceField": "source.geo.country_name"
+ },
+ "4a000000-0000-4000-8000-000000000192": {
+ "customLabel": true,
+ "dataType": "number",
+ "isBucketed": false,
+ "label": "Count",
+ "operationType": "count",
+ "params": {
+ "emptyAsNull": false
+ },
+ "sourceField": "___records___"
+ }
+ },
+ "ignoreGlobalFilters": false,
+ "incompleteColumns": {},
+ "sampling": 1
+ }
+ }
+ },
+ "indexpattern": {
+ "layers": {}
+ },
+ "textBased": {
+ "layers": {}
+ }
+ },
+ "filters": [
+ {
+ "$state": {
+ "store": "appState"
+ },
+ "meta": {
+ "alias": null,
+ "disabled": false,
+ "field": "data_stream.dataset",
+ "index": "logs-*",
+ "key": "data_stream.dataset",
+ "negate": false,
+ "params": {
+ "query": "openai_chatgpt_enterprise.audit_log"
+ },
+ "type": "phrase"
+ },
+ "query": {
+ "match_phrase": {
+ "data_stream.dataset": "openai_chatgpt_enterprise.audit_log"
+ }
+ }
+ }
+ ],
+ "internalReferences": [],
+ "query": {
+ "language": "kuery",
+ "query": ""
+ },
+ "visualization": {
+ "columns": [
+ {
+ "columnId": "4a000000-0000-4000-8000-000000000191",
+ "isMetric": false,
+ "isTransposed": false
+ },
+ {
+ "columnId": "4a000000-0000-4000-8000-000000000192",
+ "isMetric": true,
+ "isTransposed": false
+ }
+ ],
+ "layerId": "3a000000-0000-4000-8000-000000000019",
+ "layerType": "data"
+ }
+ },
+ "title": "",
+ "type": "lens",
+ "visualizationType": "lnsDatatable"
+ },
+ "enhancements": {},
+ "filters": [],
+ "query": {
+ "language": "kuery",
+ "query": ""
+ },
+ "title": "Top Source Countries"
+ },
+ "gridData": {
+ "h": 15,
+ "i": "2a000000-0000-4000-8000-000000000019",
+ "w": 12,
+ "x": 36,
+ "y": 41
+ },
+ "panelIndex": "2a000000-0000-4000-8000-000000000019",
+ "type": "lens"
+ },
+ {
+ "embeddableConfig": {
+ "attributes": {
+ "references": [
+ {
+ "id": "logs-*",
+ "name": "indexpattern-datasource-layer-3a000000-0000-4000-8000-00000000001a",
+ "type": "index-pattern"
+ }
+ ],
+ "state": {
+ "adHocDataViews": {},
+ "datasourceStates": {
+ "formBased": {
+ "layers": {
+ "3a000000-0000-4000-8000-00000000001a": {
+ "columnOrder": [
+ "4a000000-0000-4000-8000-0000000001a1",
+ "4a000000-0000-4000-8000-0000000001a2"
+ ],
+ "columns": {
+ "4a000000-0000-4000-8000-0000000001a1": {
+ "customLabel": true,
+ "dataType": "string",
+ "isBucketed": true,
+ "label": "Top User Agents",
+ "operationType": "terms",
+ "params": {
+ "missingBucket": false,
+ "orderBy": {
+ "columnId": "4a000000-0000-4000-8000-0000000001a2",
+ "type": "column"
+ },
+ "orderDirection": "desc",
+ "otherBucket": false,
+ "parentFormat": {
+ "id": "terms"
+ },
+ "size": 10
+ },
+ "sourceField": "user_agent.original"
+ },
+ "4a000000-0000-4000-8000-0000000001a2": {
+ "customLabel": true,
+ "dataType": "number",
+ "isBucketed": false,
+ "label": "Count",
+ "operationType": "count",
+ "params": {
+ "emptyAsNull": false
+ },
+ "sourceField": "___records___"
+ }
+ },
+ "ignoreGlobalFilters": false,
+ "incompleteColumns": {},
+ "sampling": 1
+ }
+ }
+ },
+ "indexpattern": {
+ "layers": {}
+ },
+ "textBased": {
+ "layers": {}
+ }
+ },
+ "filters": [
+ {
+ "$state": {
+ "store": "appState"
+ },
+ "meta": {
+ "alias": null,
+ "disabled": false,
+ "field": "data_stream.dataset",
+ "index": "logs-*",
+ "key": "data_stream.dataset",
+ "negate": false,
+ "params": {
+ "query": "openai_chatgpt_enterprise.audit_log"
+ },
+ "type": "phrase"
+ },
+ "query": {
+ "match_phrase": {
+ "data_stream.dataset": "openai_chatgpt_enterprise.audit_log"
+ }
+ }
+ }
+ ],
+ "internalReferences": [],
+ "query": {
+ "language": "kuery",
+ "query": ""
+ },
+ "visualization": {
+ "columns": [
+ {
+ "columnId": "4a000000-0000-4000-8000-0000000001a1",
+ "isMetric": false,
+ "isTransposed": false
+ },
+ {
+ "columnId": "4a000000-0000-4000-8000-0000000001a2",
+ "isMetric": true,
+ "isTransposed": false
+ }
+ ],
+ "layerId": "3a000000-0000-4000-8000-00000000001a",
+ "layerType": "data"
+ }
+ },
+ "title": "",
+ "type": "lens",
+ "visualizationType": "lnsDatatable"
+ },
+ "enhancements": {},
+ "filters": [],
+ "query": {
+ "language": "kuery",
+ "query": ""
+ },
+ "title": "Top User Agents"
+ },
+ "gridData": {
+ "h": 15,
+ "i": "2a000000-0000-4000-8000-00000000001a",
+ "w": 48,
+ "x": 0,
+ "y": 56
+ },
+ "panelIndex": "2a000000-0000-4000-8000-00000000001a",
+ "type": "lens"
+ },
+ {
+ "embeddableConfig": {
+ "savedObjectId": "openai_chatgpt_enterprise-8a4b2c3d-1e5f-4b6a-8c7d-2b3c4d5e6f71"
+ },
+ "gridData": {
+ "h": 15,
+ "i": "2a000000-0000-4000-8000-00000000001b",
+ "w": 48,
+ "x": 0,
+ "y": 71
+ },
+ "panelIndex": "2a000000-0000-4000-8000-00000000001b",
+ "panelRefName": "panel_2a000000-0000-4000-8000-00000000001b",
+ "type": "search"
+ }
+ ],
+ "timeRestore": false,
+ "title": "[Logs OpenAI ChatGPT Enterprise] Audit Logs",
+ "version": 3
+ },
+ "coreMigrationVersion": "8.8.0",
+ "created_at": "2026-07-19T18:38:51.899Z",
+ "id": "openai_chatgpt_enterprise-7c1f2a3b-4d5e-4f60-8a71-2b3c4d5e6f01",
+ "references": [
+ {
+ "id": "logs-*",
+ "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index",
+ "type": "index-pattern"
+ },
+ {
+ "id": "logs-*",
+ "name": "2a000000-0000-4000-8000-000000000010:indexpattern-datasource-layer-3a000000-0000-4000-8000-000000000010",
+ "type": "index-pattern"
+ },
+ {
+ "id": "logs-*",
+ "name": "2a000000-0000-4000-8000-000000000011:indexpattern-datasource-layer-3a000000-0000-4000-8000-000000000011",
+ "type": "index-pattern"
+ },
+ {
+ "id": "logs-*",
+ "name": "2a000000-0000-4000-8000-000000000012:indexpattern-datasource-layer-3a000000-0000-4000-8000-000000000012",
+ "type": "index-pattern"
+ },
+ {
+ "id": "logs-*",
+ "name": "2a000000-0000-4000-8000-000000000013:indexpattern-datasource-layer-3a000000-0000-4000-8000-000000000013",
+ "type": "index-pattern"
+ },
+ {
+ "id": "logs-*",
+ "name": "2a000000-0000-4000-8000-000000000014:indexpattern-datasource-layer-3a000000-0000-4000-8000-000000000014",
+ "type": "index-pattern"
+ },
+ {
+ "id": "logs-*",
+ "name": "2a000000-0000-4000-8000-000000000015:indexpattern-datasource-layer-3a000000-0000-4000-8000-000000000015",
+ "type": "index-pattern"
+ },
+ {
+ "id": "logs-*",
+ "name": "2a000000-0000-4000-8000-000000000016:indexpattern-datasource-layer-3a000000-0000-4000-8000-000000000016",
+ "type": "index-pattern"
+ },
+ {
+ "id": "logs-*",
+ "name": "2a000000-0000-4000-8000-000000000017:indexpattern-datasource-layer-3a000000-0000-4000-8000-000000000017",
+ "type": "index-pattern"
+ },
+ {
+ "id": "logs-*",
+ "name": "2a000000-0000-4000-8000-000000000018:indexpattern-datasource-layer-3a000000-0000-4000-8000-000000000018",
+ "type": "index-pattern"
+ },
+ {
+ "id": "logs-*",
+ "name": "2a000000-0000-4000-8000-000000000019:indexpattern-datasource-layer-3a000000-0000-4000-8000-000000000019",
+ "type": "index-pattern"
+ },
+ {
+ "id": "logs-*",
+ "name": "2a000000-0000-4000-8000-00000000001a:indexpattern-datasource-layer-3a000000-0000-4000-8000-00000000001a",
+ "type": "index-pattern"
+ },
+ {
+ "id": "openai_chatgpt_enterprise-8a4b2c3d-1e5f-4b6a-8c7d-2b3c4d5e6f71",
+ "name": "2a000000-0000-4000-8000-00000000001b:panel_2a000000-0000-4000-8000-00000000001b",
+ "type": "search"
+ },
+ {
+ "id": "openai_chatgpt_enterprise-8a4b2c3d-1e5f-4b6a-8c7d-2b3c4d5e6f71",
+ "name": "2a000000-0000-4000-8000-00000000001b:panel_2a000000-0000-4000-8000-00000000001b",
+ "type": "search"
+ },
+ {
+ "id": "openai_chatgpt_enterprise-8a4b2c3d-1e5f-4b6a-8c7d-2b3c4d5e6f71",
+ "name": "2a000000-0000-4000-8000-00000000001b:panel_2a000000-0000-4000-8000-00000000001b",
+ "type": "search"
+ },
+ {
+ "id": "logs-*",
+ "name": "controlGroup_1a000000-0000-4000-8000-000000000001:optionsListDataView",
+ "type": "index-pattern"
+ },
+ {
+ "id": "logs-*",
+ "name": "controlGroup_1a000000-0000-4000-8000-000000000002:optionsListDataView",
+ "type": "index-pattern"
+ },
+ {
+ "id": "logs-*",
+ "name": "controlGroup_1a000000-0000-4000-8000-000000000003:optionsListDataView",
+ "type": "index-pattern"
+ },
+ {
+ "id": "logs-*",
+ "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index",
+ "type": "index-pattern"
+ }
+ ],
+ "type": "dashboard",
+ "typeMigrationVersion": "10.3.0"
+}
\ No newline at end of file
diff --git a/packages/openai_chatgpt_enterprise/kibana/search/openai_chatgpt_enterprise-8a4b2c3d-1e5f-4b6a-8c7d-2b3c4d5e6f71.json b/packages/openai_chatgpt_enterprise/kibana/search/openai_chatgpt_enterprise-8a4b2c3d-1e5f-4b6a-8c7d-2b3c4d5e6f71.json
new file mode 100644
index 00000000000..6b477e69b95
--- /dev/null
+++ b/packages/openai_chatgpt_enterprise/kibana/search/openai_chatgpt_enterprise-8a4b2c3d-1e5f-4b6a-8c7d-2b3c4d5e6f71.json
@@ -0,0 +1,47 @@
+{
+ "attributes": {
+ "columns": [
+ "event.action",
+ "user.email",
+ "openai_chatgpt_enterprise.audit_log.actor.type",
+ "openai_chatgpt_enterprise.audit_log.action_privilege",
+ "event.outcome",
+ "source.ip",
+ "source.geo.country_name"
+ ],
+ "description": "",
+ "grid": {},
+ "hideChart": false,
+ "isTextBasedQuery": false,
+ "kibanaSavedObjectMeta": {
+ "searchSourceJSON": {
+ "filter": [],
+ "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index",
+ "query": {
+ "language": "kuery",
+ "query": "data_stream.dataset : \"openai_chatgpt_enterprise.audit_log\""
+ }
+ }
+ },
+ "sort": [
+ [
+ "@timestamp",
+ "desc"
+ ]
+ ],
+ "timeRestore": false,
+ "title": "[Logs OpenAI ChatGPT Enterprise] Latest Audit Events"
+ },
+ "coreMigrationVersion": "8.8.0",
+ "created_at": "2026-07-19T18:38:37.709Z",
+ "id": "openai_chatgpt_enterprise-8a4b2c3d-1e5f-4b6a-8c7d-2b3c4d5e6f71",
+ "references": [
+ {
+ "id": "logs-*",
+ "name": "kibanaSavedObjectMeta.searchSourceJSON.index",
+ "type": "index-pattern"
+ }
+ ],
+ "type": "search",
+ "typeMigrationVersion": "10.5.0"
+}
\ No newline at end of file
diff --git a/packages/openai_chatgpt_enterprise/manifest.yml b/packages/openai_chatgpt_enterprise/manifest.yml
new file mode 100644
index 00000000000..b1666e5f425
--- /dev/null
+++ b/packages/openai_chatgpt_enterprise/manifest.yml
@@ -0,0 +1,96 @@
+format_version: 3.3.2
+name: openai_chatgpt_enterprise
+title: OpenAI ChatGPT Enterprise
+version: 0.1.0
+description: Collect ChatGPT Enterprise compliance logs from the OpenAI Compliance Logs Platform with Elastic Agent.
+type: integration
+categories:
+ - security
+ - observability
+conditions:
+ kibana:
+ version: '^8.18.0 || ^9.0.0'
+ elastic:
+ subscription: 'basic'
+screenshots:
+ - src: /img/audit-log-dashboard.png
+ title: OpenAI ChatGPT Enterprise Audit Logs dashboard
+ size: 600x600
+ type: image/png
+icons:
+ - src: /img/openai-logo.svg
+ title: OpenAI logo
+ size: 512x138
+ type: image/svg+xml
+policy_templates:
+ - name: openai_chatgpt_enterprise
+ title: OpenAI ChatGPT Enterprise compliance logs
+ description: Collect ChatGPT Enterprise compliance logs from the OpenAI Compliance Logs Platform.
+ deployment_modes:
+ default:
+ enabled: true
+ agentless:
+ enabled: true
+ release: beta
+ organization: security
+ division: engineering
+ team: security-service-integrations
+ inputs:
+ - type: cel
+ title: Collect ChatGPT Enterprise compliance logs
+ description: Collect ChatGPT Enterprise compliance logs from the OpenAI Compliance Logs Platform.
+ vars:
+ - name: url
+ type: url
+ title: URL
+ description: Base URL of the OpenAI Compliance Logs Platform API.
+ default: https://api.chatgpt.com
+ required: true
+ show_user: true
+ - name: admin_token
+ type: password
+ title: Compliance API key
+ description: Compliance API key authorized for enterprise logs. See [Compliance API for enterprise customers](https://help.openai.com/en/articles/9261474-compliance-api-for-enterprise-customers) for more information.
+ multi: false
+ required: true
+ show_user: true
+ secret: true
+ - name: proxy_url
+ type: text
+ title: Proxy URL
+ multi: false
+ required: false
+ show_user: false
+ description: URL to proxy connections in the form of http[s]://:@:. Please ensure your username and password are in URL encoded format.
+ - name: ssl
+ type: yaml
+ title: SSL Configuration
+ description: SSL configuration options. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) for details.
+ multi: false
+ required: false
+ show_user: false
+ default: |
+ #certificate_authorities:
+ # - |
+ # -----BEGIN CERTIFICATE-----
+ # MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF
+ # ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2
+ # MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB
+ # BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n
+ # fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl
+ # 94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t
+ # /D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP
+ # PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41
+ # CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O
+ # BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux
+ # 8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D
+ # 874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw
+ # 3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA
+ # H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu
+ # 8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0
+ # yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk
+ # sxSmbIUfc2SGJGCJD4I=
+ # -----END CERTIFICATE-----
+owner:
+ github: elastic/security-service-integrations
+ type: elastic
diff --git a/packages/openai_chatgpt_enterprise/validation.yml b/packages/openai_chatgpt_enterprise/validation.yml
new file mode 100644
index 00000000000..4570f179e4e
--- /dev/null
+++ b/packages/openai_chatgpt_enterprise/validation.yml
@@ -0,0 +1,3 @@
+errors:
+ exclude_checks:
+ - SVR00004