elastic · muskan-agarwal26 · Jul 19, 2026 · Jul 19, 2026
diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
@@ -434,6 +434,7 @@
 /packages/openai/data_stream/moderations @elastic/obs-infraobs-integrations
 /packages/openai/data_stream/rate_limits @elastic/obs-infraobs-integrations
 /packages/openai/data_stream/vector_stores @elastic/obs-infraobs-integrations
+/packages/openai_chatgpt_enterprise @elastic/security-service-integrations
 /packages/opencanary @elastic/security-service-integrations @elastic/sit-crest-contractors
 /packages/oracle @elastic/obs-infraobs-integrations
 /packages/oracle_otel @elastic/obs-infraobs-integrations

@@ -0,0 +1,3 @@
+dependencies:
+  ecs:
+    reference: git@v9.4.0
@@ -0,0 +1,110 @@
+# OpenAI ChatGPT Enterprise Integration for Elastic
+
+## Overview
+
+[OpenAI ChatGPT Enterprise](https://openai.com/chatgpt/enterprise/) is the enterprise offering of ChatGPT, providing workspace administration, security controls, and compliance capabilities for organizations. The [Compliance Logs Platform](https://help.openai.com/en/articles/9261474-compliance-api-for-enterprise-customers) exposes the compliance events generated across a workspace or organization, including administrative activity, authentication, application access, and Codex activity.
+
+This integration for Elastic allows you to collect ChatGPT Enterprise compliance logs using the OpenAI Compliance Logs Platform API, then visualize the data in Kibana.
+
+### Compatibility
+
+This integration is compatible with the OpenAI Compliance Logs Platform API for ChatGPT Enterprise customers.
+
+### How it works
+
+This integration periodically queries the OpenAI Compliance Logs Platform API to retrieve compliance logs. Collection is a two-step (chained) process: the integration first lists the available log files for the configured event type, then downloads each log file and emits every JSON Lines record it contains as an individual event.
+
+## What data does this integration collect?
+
+This integration collects log messages of the following type:
+
+- `Audit Logs`: Collect administrative and workspace audit activity (event type: `AUDIT_LOG`) from the OpenAI Compliance Logs Platform. Each audit event captures the action performed, the acting principal, the outcome, and request metadata such as client IP and user agent.
+
+### Supported use cases
+
+Bringing OpenAI ChatGPT Enterprise Audit Logs into Elastic gives security and compliance teams a searchable, correlatable record of administrative and workspace activity. Audit events describe who performed which action, on which resource, from where, and whether the action succeeded, was blocked, or failed.
+
+Use the `audit_log` data stream to monitor privileged administrative actions (role changes, application access grants, feature toggles, invitations, and workspace policy updates), investigate suspicious activity by user, IP, or geography, and track outcome trends over time. Bundled dashboards summarize activity volume, top actions, top users, action outcomes, and source geography for day-to-day monitoring and investigation.
+
+## What do I need to use this integration?
+
+### From OpenAI
+
+To collect data through the OpenAI Compliance Logs Platform API, you need a **Compliance API key** authorized for enterprise logs and the **Workspace ID** or **Organization ID** whose compliance logs you want to collect.
+
+1. Ensure your account has access to the [Compliance API for enterprise customers](https://help.openai.com/en/articles/9261474-compliance-api-for-enterprise-customers).
+2. Generate a **Compliance API key** authorized for enterprise logs.
+3. Obtain the **Workspace ID** (when Scope is `workspace`) or the **Organization ID** (when Scope is `organization`) whose logs will be collected.
+4. Store these values securely for use in the integration configuration.
+
+## How do I deploy this integration?
+
+This integration supports both Elastic Agentless-based and Agent-based installations.
+
+### Agent-based deployment
+
+Elastic Agent must be installed. For more details, check the Elastic Agent [installation instructions](docs-content://reference/fleet/install-elastic-agents.md). You can install only one Elastic Agent per host.
+
+Elastic Agent is required to stream data from the OpenAI Compliance Logs Platform API and ship the data to Elastic, where the events will then be processed via the integration's ingest pipelines.
+
+### Agentless deployment
+
+Agentless deployments are only supported in Elastic Serverless and Elastic Cloud environments. Agentless deployments provide a means to ingest data while avoiding the orchestration, management, and maintenance needs associated with standard ingest infrastructure. Using an agentless deployment makes manual agent deployment unnecessary, allowing you to focus on your data instead of the agent that collects it.
+
+For more information, refer to [Agentless integrations](https://www.elastic.co/guide/en/serverless/current/security-agentless-integrations.html) and [Agentless integrations FAQ](https://www.elastic.co/guide/en/serverless/current/agentless-integration-troubleshooting.html)
+
+### Configure
+
+1. In the top search bar in Kibana, search for **Integrations**.
+2. In the search bar, type **OpenAI ChatGPT Enterprise**.
+3. Select the **OpenAI ChatGPT Enterprise** integration from the search results.
+4. Select **Add OpenAI ChatGPT Enterprise** to add the integration.
+5. Enable and configure the collection method:
+
+    * To **Collect ChatGPT Enterprise compliance logs**, you'll need to:
+
+        - Configure the **URL** and **Compliance API key**.
+        - Set the **Scope** (`workspace` or `organization`) and the corresponding **Workspace / Organization ID**.
+        - Adjust the integration configuration parameters if required, including the Interval, Initial Interval, and HTTP Client Timeout to enable data collection.
+
+6. Select **Save and continue** to save the integration.
+
+### Validation
+
+#### Dashboard populated
+
+1. In the top search bar in Kibana, search for **Dashboards**.
+2. In the search bar, type **OpenAI ChatGPT Enterprise**, and verify the dashboard information is populated.
+
+## Troubleshooting
+
+For help with Elastic ingest tools, check [Common problems](https://www.elastic.co/docs/troubleshoot/ingest/fleet/common-problems).
+
+## Scaling
+
+For more information on architectures that can be used for scaling this integration, check the [Ingest Architectures](https://www.elastic.co/docs/manage-data/ingest/ingest-reference-architectures) documentation.
+
+## Reference
+
+### Audit Logs
+
+The `audit_log` data stream provides administrative and workspace audit events from the OpenAI ChatGPT Enterprise Compliance Logs Platform.
+
+#### Audit Log fields
+
+{{ fields "audit_log" }}
+
+### Example event
+
+{{ event "audit_log" }}
+
+### Inputs used
+{{/* All inputs used by this package will be automatically listed here. */}}
+{{ inputDocs }}
+
+### API usage
+
+These APIs are used with this integration:
+
+* List compliance log files (endpoint: `GET /v1/compliance/workspaces/{workspace_id}/logs` or `GET /v1/compliance/organizations/{organization_id}/logs`)
+* Download a compliance log file (endpoint: `GET /v1/compliance/workspaces/{workspace_id}/logs/{log_file_id}` or `GET /v1/compliance/organizations/{organization_id}/logs/{log_file_id}`)
@@ -0,0 +1,15 @@
+version: '3.8'
+services:
+  openai_chatgpt_enterprise:
+    image: docker.elastic.co/observability/stream:v0.22.0
+    hostname: openai_chatgpt_enterprise
+    ports:
+      - 8090
+    volumes:
+      - ./files:/files:ro
+    environment:
+      PORT: '8090'
+    command:
+      - http-server
+      - --addr=:8090
+      - --config=/files/config.yml
@@ -0,0 +1,238 @@
+rules:
+  # --- PHASE 1: list log files — page 2 (requested with ?after=2026-07-09T12:00:00Z) ---
+  - path: /v1/compliance/workspaces/ws-example-001/logs
+    methods: ['GET']
+    query_params:
+      event_type: AUDIT_LOG
+      limit: 2
+      after: "2026-07-09T12:00:00Z"
+    request_headers:
+      Authorization:
+        - "Bearer xxxx"
+    responses:
+      - status_code: 200
+        headers:
+          Content-Type:
+            - 'application/json'
+        body: |-
+          {{ minify_json `
+          {
+            "data": [
+              {
+                "id": "eclf_a3000000000000000000000000000003",
+                "event_type": "AUDIT_LOG",
+                "end_time": "2026-07-09T13:00:00.000000Z",
+                "file_name": "AUDIT_LOG_2026-07-09T13:00:00.000000+00:00.jsonl",
+                "file_size": 2048,
+                "file_sha256": "c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3"
+              }
+            ],
+            "has_more": false,
+            "last_end_time": "2026-07-09T13:00:00Z"
+          }
+          `}}
+
+  # --- PHASE 1: list log files — page 1 (initial request) ---
+  - path: /v1/compliance/workspaces/ws-example-001/logs
+    methods: ['GET']
+    query_params:
+      event_type: AUDIT_LOG
+      limit: 2
+    request_headers:
+      Authorization:
+        - "Bearer xxxx"
+    responses:
+      - status_code: 200
+        headers:
+          Content-Type:
+            - 'application/json'
+        body: |-
+          {{ minify_json `
+          {
+            "data": [
+              {
+                "id": "eclf_a1000000000000000000000000000001",
+                "event_type": "AUDIT_LOG",
+                "end_time": "2026-07-09T11:30:00.000000Z",
+                "file_name": "AUDIT_LOG_2026-07-09T11:30:00.000000+00:00.jsonl",
+                "file_size": 1024,
+                "file_sha256": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1"
+              },
+              {
+                "id": "eclf_a2000000000000000000000000000002",
+                "event_type": "AUDIT_LOG",
+                "end_time": "2026-07-09T11:55:00.000000Z",
+                "file_name": "AUDIT_LOG_2026-07-09T11:55:00.000000+00:00.jsonl",
+                "file_size": 1536,
+                "file_sha256": "a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2"
+              }
+            ],
+            "has_more": true,
+            "last_end_time": "2026-07-09T12:00:00Z"
+          }
+          `}}
+
+  # --- PHASE 2: download log file eclf_a1 (JSON Lines body) ---
+  - path: /v1/compliance/workspaces/ws-example-001/logs/eclf_a1000000000000000000000000000001
+    methods: ['GET']
+    request_headers:
+      Authorization:
+        - "Bearer xxxx"
+    responses:
+      - status_code: 200
+        headers:
+          Content-Type:
+            - 'application/x-ndjson'
+        body: |-
+          {{ minify_json `
+          {
+            "event_id": "92b7dea7-9ff4-485e-b0a0-74efa627f15b",
+            "type": "AUDIT_LOG",
+            "principal": {"id": "be545252-ad04-4cfa-9ca5-deca58416151", "type": "CHATGPT_WORKSPACE"},
+            "actor": {"type": "API_KEY", "redacted_id": "sk-...RxIA"},
+            "timestamp": "2026-07-09T11:05:09.077133Z",
+            "action_result": "SUCCESS",
+            "action_privilege": "ADMIN",
+            "request_metadata": {
+              "client_ip": "81.2.69.142",
+              "client_ip_details": {"country": "GB", "city": "London", "region": "England", "region_code": "ENG", "asn": "", "latitude": "51.50853", "longitude": "-0.12574"},
+              "client_user_agent": "python-requests/2.34.2",
+              "client_ja3": "86dab2109182b6bbaa644647d7db2997",
+              "client_ja4": "t13d1713h1_ab0a1bf427ad_8537cf56674e",
+              "destination_hostname": "api.chatgpt.com"
+            },
+            "action_data": {"limit": "100", "after": "2026-07-09T10:24:53.814285Z", "event_type": "AUDIT_LOG"},
+            "action": "LIST_WORKSPACE_LOG_FILES"
+          }
+          `}}
+          {{ minify_json `
+          {
+            "event_id": "8b5e7eff-e114-475e-ad8b-8c443f55a1f2",
+            "type": "AUDIT_LOG",
+            "principal": {"id": "be545252-ad04-4cfa-9ca5-deca58416151", "type": "CHATGPT_WORKSPACE"},
+            "actor": {"type": "API_KEY", "redacted_id": "sk-...RxIA"},
+            "timestamp": "2026-07-09T11:05:09.292963Z",
+            "action_result": "SUCCESS",
+            "action_privilege": "ADMIN",
+            "request_metadata": {
+              "client_ip": "81.2.69.142",
+              "client_ip_details": {"country": "GB", "city": "London", "region": "England", "region_code": "ENG", "asn": "", "latitude": "51.50853", "longitude": "-0.12574"},
+              "client_user_agent": "python-requests/2.34.2",
+              "client_ja3": "86dab2109182b6bbaa644647d7db2997",
+              "client_ja4": "t13d1713h1_ab0a1bf427ad_8537cf56674e",
+              "destination_hostname": "api.chatgpt.com"
+            },
+            "action_data": {"log_file_id": "eclf_6a5cc4957340819181cb409f513e791c", "event_type": "AUDIT_LOG"},
+            "action": "DOWNLOAD_WORKSPACE_LOG_FILE"
+          }
+          `}}
+
+  # --- PHASE 2: download log file eclf_a2 (JSON Lines body) ---
+  - path: /v1/compliance/workspaces/ws-example-001/logs/eclf_a2000000000000000000000000000002
+    methods: ['GET']
+    request_headers:
+      Authorization:
+        - "Bearer xxxx"
+    responses:
+      - status_code: 200
+        headers:
+          Content-Type:
+            - 'application/x-ndjson'
+        body: |-
+          {{ minify_json `
+          {
+            "event_id": "344039bd-e40b-4020-8256-e44f7bbeeb3e",
+            "type": "AUDIT_LOG",
+            "principal": {"id": "be545252-ad04-4cfa-9ca5-deca58416151", "type": "CHATGPT_WORKSPACE"},
+            "actor": {"type": "ACCOUNT_USER", "user_id": "user-Aa11QwErTyUiOp", "user_email": "alice.martin@example.com"},
+            "timestamp": "2026-07-09T11:40:00.000000Z",
+            "action_result": "SUCCESS",
+            "action_privilege": "ADMIN",
+            "request_metadata": {
+              "client_ip": "89.160.20.112",
+              "client_ip_details": {"country": "SE", "city": "Linkoping", "region": "Ostergotland", "region_code": "E", "asn": "AS29518", "latitude": "58.4167", "longitude": "15.6167"},
+              "client_user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36",
+              "client_ja3": "",
+              "client_ja4": "",
+              "destination_hostname": null
+            },
+            "action_data": {"user_id": "user-Bb22AsDfGhJkLp", "new_role": "manager"},
+            "action": "USER_ROLE_UPDATED"
+          }
+          `}}
+          {{ minify_json `
+          {
+            "event_id": "b4ef3def-93af-43da-ac94-e7c79c34f4a1",
+            "type": "AUDIT_LOG",
+            "principal": {"id": "be545252-ad04-4cfa-9ca5-deca58416151", "type": "CHATGPT_WORKSPACE"},
+            "actor": {"type": "ACCOUNT_USER", "user_id": "user-Aa11QwErTyUiOp", "user_email": "alice.martin@example.com"},
+            "timestamp": "2026-07-09T11:45:00.000000Z",
+            "action_result": "SUCCESS",
+            "action_privilege": "ADMIN",
+            "request_metadata": {
+              "client_ip": "89.160.20.112",
+              "client_ip_details": {"country": "SE", "city": "Linkoping", "region": "Ostergotland", "region_code": "E", "asn": "AS29518", "latitude": "58.4167", "longitude": "15.6167"},
+              "client_user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36",
+              "client_ja3": "",
+              "client_ja4": "",
+              "destination_hostname": null
+            },
+            "action_data": {"app_id": "app-001", "app_name": "gdrive", "allowed_user_id": "user-Cc33ZxCvBnMkLo"},
+            "action": "APP_ALLOW_USER"
+          }
+          `}}
+
+  # --- PHASE 2: download log file eclf_a3 (JSON Lines body) ---
+  - path: /v1/compliance/workspaces/ws-example-001/logs/eclf_a3000000000000000000000000000003
+    methods: ['GET']
+    request_headers:
+      Authorization:
+        - "Bearer xxxx"
+    responses:
+      - status_code: 200
+        headers:
+          Content-Type:
+            - 'application/x-ndjson'
+        body: |-
+          {{ minify_json `
+          {
+            "event_id": "f7ce6f1c-2f08-4692-973e-3919427bde82",
+            "type": "AUDIT_LOG",
+            "principal": {"id": "be545252-ad04-4cfa-9ca5-deca58416151", "type": "CHATGPT_WORKSPACE"},
+            "actor": {"type": "ACCOUNT_USER", "user_id": "user-Aa11QwErTyUiOp", "user_email": "alice.martin@example.com"},
+            "timestamp": "2026-07-09T12:30:00.000000Z",
+            "action_result": "SUCCESS",
+            "action_privilege": "ADMIN",
+            "request_metadata": {
+              "client_ip": "81.2.69.142",
+              "client_ip_details": {"country": "GB", "city": "London", "region": "England", "region_code": "ENG", "asn": "", "latitude": "51.50853", "longitude": "-0.12574"},
+              "client_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Firefox/127.0",
+              "client_ja3": "",
+              "client_ja4": "",
+              "destination_hostname": null
+            },
+            "action_data": {"feature": "gpt_sharing", "value": true},
+            "action": "WORKSPACE_TOGGLE_FEATURE"
+          }
+          `}}
+          {{ minify_json `
+          {
+            "event_id": "b521d25e-0a2c-4b69-bfcc-70c0fdfadd03",
+            "type": "AUDIT_LOG",
+            "principal": {"id": "be545252-ad04-4cfa-9ca5-deca58416151", "type": "CHATGPT_WORKSPACE"},
+            "actor": {"type": "ACCOUNT_USER", "user_id": "user-Aa11QwErTyUiOp", "user_email": "alice.martin@example.com"},
+            "timestamp": "2026-07-09T12:50:00.000000Z",
+            "action_result": "SUCCESS",
+            "action_privilege": "ADMIN",
+            "request_metadata": {
+              "client_ip": "81.2.69.142",
+              "client_ip_details": {"country": "GB", "city": "London", "region": "England", "region_code": "ENG", "asn": "", "latitude": "51.50853", "longitude": "-0.12574"},
+              "client_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Firefox/127.0",
+              "client_ja3": "",
+              "client_ja4": "",
+              "destination_hostname": null
+            },
+            "action_data": {"email_addresses": ["new.hire@example.com"], "role": "user"},
+            "action": "INVITE_SEND"
+          }
+          `}}
@@ -0,0 +1,6 @@
+# newer versions go on top
+- version: '0.1.0'
+  changes:
+    - description: Initial release of the OpenAI ChatGPT Enterprise Audit Logs (audit_log) data stream.
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/20210