Detection rule: OpenAI ChatGPT Enterprise Memory Deleted. This ES|QL detection watches OpenAI ChatGPT Enterprise audit logs for memory deletion events (event.action == delete_memory) within the openai_chatgpt_enterprise.audit_log dataset. It is designed to identify potential defense-evasion activity where an adversary or actor with access deletes stored conversational context or prompts to obscure prior actions. The rule relies on the OpenAI ChatGPT Enterprise integration to ship compliance/audit logs into Elasticsearch and uses a dedicated query against logs-openai_chatgpt_enterprise.audit_log-* to surface relevant fields such as memory_id, user identifiers, source IP, and related action data. The rule maps to MITRE ATT&CK T1070 (Indicator Removal) under the Defense Evasion tactic and to MITRE ATLAS AML.T0092 (Manipulate User LLM Chat History). The rule’s risk score is 47 with a severity of medium, indicating a moderate but notable incident signal. It is intended to trigger investigations when memory deletion is coupled with unusual activity, credential exposure, or other defense-evasion indicators from the same user; routine user-driven memory cleanup should be treated as a false positive and closed accordingly. The setup requires enabling the OpenAI ChatGPT Enterprise integration to collect compliance logs. Investigation guidance includes identifying the involved user and memory identifiers, reviewing recent conversations and Codex activity for sensitive or policy-violating content, correlating with nearby mass deletions or data sharing, and confirming whether the deletion was intentional with corroborating activity. False positives primarily arise from users performing personalization or privacy-related cleanup. Remediation guidance emphasizes preserving audit history and correlating the deletion with surrounding activity to determine if concealment occurred. References include Elastic’s OpenAI ChatGPT Enterprise integration docs and OpenAI compliance docs. The rule supports security teams by providing structured indicators (memory_id, user_id, IP, action_privilege, etc.) to triage potential memory deletion incidents and determine appropriate containment or remediation actions.