Description
The current OpenAI integration is limited to tracking API usage metrics via their Usage API. It lacks coverage for the security, compliance, and data governance use cases that enterprise customers increasingly require.
OpenAI's Compliance Platform (available to Enterprise customers) provides access to conversation logs and workspace metadata designed for integration with eDiscovery, DLP, and SIEM tooling.
Enterprise security and compliance teams need visibility into:
- Data Loss Prevention (DLP): Detecting unauthorized use or exfiltration of sensitive information through ChatGPT Enterprise (e.g., PII, IP, regulated data)
- eDiscovery: Collecting and preserving conversation records for litigation, investigations, or audits
- Security monitoring: Real-time analysis of ChatGPT workspace activity via SIEM pipelines
- Audit readiness: Immutable, append-only compliance log events for governance and regulatory requirements (GDPR, HIPAA, etc.)
Audit datastream:
OpenAI provides organization-level audit events via the OpenAI Admin API, covering actions such as API key creation, updates, and deletions, project changes, and user activity.
Proposed scope:
- Ingestion of OpenAI Audit Logs via
/v1/organization/audit_logs
- Cursor-based pagination and incremental collection
- ECS-aligned field mappings (actor, event type, timestamps, affected resources)
- Dashboards
- Secure handling of OpenAI Admin API keys
Compliance datastream:
OpenAI's Compliance Platform (available to Enterprise customers) provides access to conversation logs and workspace metadata designed for integration with eDiscovery, DLP, and SIEM tooling. It supports two access patterns:
- Compliance Logs Platform: immutable, append-only event logs for auditing (conversation message logs, workspace activity)
- Stateful Compliance API: point-in-time queries for joining referenced data and accessing legacy data types
⚠️ Deprecation note: On March 5, 2026, OpenAI released a new conversations log system, deprecating the old stateful route. The stateful route will be removed June 5, 2026. The integration should target the new Compliance Logs Platform.
Proposed scope:
- Ingestion of conversation logs and compliance events from the OpenAI Compliance Logs Platform
- Continuous/incremental log collection aligned with the 30-day retention window
- ECS-aligned field mappings (actor, event type, timestamps, workspace metadata)
- Support for downstream DLP, eDiscovery, and SIEM workflows
- Dashboards for anomalous ChatGPT usage patterns
- Secure handling of OpenAI Enterprise Compliance API credentials
Access requirement: The Compliance Platform is available to OpenAI Enterprise customers only. A test Enterprise workspace or partner access will be needed for development and validation.
Market context:
OpenAI already has 13 Compliance API partner integrations from vendors including CrowdStrike, Microsoft Purview, Netskope, Palo Alto Networks, and Zscaler — several of which are also Elastic technology partners. Coverage of both datastreams would position Elastic alongside these vendors in the enterprise compliance space and strengthen the joint customer story.
Description
The current OpenAI integration is limited to tracking API usage metrics via their Usage API. It lacks coverage for the security, compliance, and data governance use cases that enterprise customers increasingly require.
OpenAI's Compliance Platform (available to Enterprise customers) provides access to conversation logs and workspace metadata designed for integration with eDiscovery, DLP, and SIEM tooling.
Enterprise security and compliance teams need visibility into:
Audit datastream:
OpenAI provides organization-level audit events via the OpenAI Admin API, covering actions such as API key creation, updates, and deletions, project changes, and user activity.
Proposed scope:
/v1/organization/audit_logsCompliance datastream:
OpenAI's Compliance Platform (available to Enterprise customers) provides access to conversation logs and workspace metadata designed for integration with eDiscovery, DLP, and SIEM tooling. It supports two access patterns:
Proposed scope:
Access requirement: The Compliance Platform is available to OpenAI Enterprise customers only. A test Enterprise workspace or partner access will be needed for development and validation.
Market context:
OpenAI already has 13 Compliance API partner integrations from vendors including CrowdStrike, Microsoft Purview, Netskope, Palo Alto Networks, and Zscaler — several of which are also Elastic technology partners. Coverage of both datastreams would position Elastic alongside these vendors in the enterprise compliance space and strengthen the joint customer story.