ChatGPT

1. 01ChatGPT trains on data unless a business tier or opt-out is used. Verify which tier these users are on.
2. 02505 MB left for ChatGPT through Splunk (demo) in 30 days. Check the proxy or firewall for file uploads and pair this with a DLP rule for AI destinations.
3. 03Splunk (demo) confirms what Microsoft 365 signals show for ChatGPT. Use the source list here to find the exact devices and network segments involved.

• ▲Critical85ChatGPTEntra consentall users
• ◆High51ChatGPTNetwork11 people
• ●Medium48ChatGPTEndpoint2 people
• ◆High58ChatGPTEmail4 people
• ◆High60ChatGPT via Power PlatformAzure & Power Platform3 people
• ◆High70ChatGPT: sensitive dataPurview DLP3 people
• ▲Critical81ChatGPTCode · GitHub (demo)0 people
• ●Medium38ChatGPTOkta (demo)10 people
• ●Medium30ChatGPTGoogle Workspace (demo)5 people

Identifiers come from device telemetry and proxy logs, so they may be account names rather than full directory entries.

1. siem_traffic · Sep 14, 2026
   Splunk (demo): 21007 events to api.openai.com, chatgpt.com from 3 users and 5 sources in 30 days, 505 MB uploaded
   Detail

   {
     "hosts": [
       {
         "host": "api.openai.com",
         "events": 18400,
         "bytesOut": 429916160
       },
       {
         "host": "chatgpt.com",
         "events": 2607,
         "bytesOut": 99614720
       }
     ],
     "bytesIn": 494927872,
     "bytesOut": 529530880,
     "topUsers": [
       {
         "user": "svc-datapipeline",
         "events": 18400
       },
       {
         "user": "[email protected]",
         "events": 1460
       },
       {
         "user": "[email protected]",
         "events": 812
       }
     ],
     "topSources": [
       {
         "events": 18400,
         "source": "10.10.1.9"
       },
       {
         "events": 1460,
         "source": "10.20.4.52"
       },
       {
         "events": 812,
         "source": "10.20.4.17"
       },
       {
         "events": 240,
         "source": "10.30.8.201"
       },
       {
         "events": 95,
         "source": "10.30.8.77"
       }
     ]
   }

2. corroboration
   Also found by another lane (consent:aaaa0002-0000-4000-8000-000000000002)
   Detail

   {
     "findingKey": "consent:aaaa0002-0000-4000-8000-000000000002"
   }

3. corroboration
   Also found by another lane (mdca:11114)
   Detail

   {
     "findingKey": "mdca:11114"
   }

4. corroboration
   Also found by another lane (mail:openai-chatgpt)
   Detail

   {
     "findingKey": "mail:openai-chatgpt"
   }

5. corroboration
   Also found by another lane (pp:shared_openai)
   Detail

   {
     "findingKey": "pp:shared_openai"
   }

6. corroboration
   Also found by another lane (dlp:openai-chatgpt)
   Detail

   {
     "findingKey": "dlp:openai-chatgpt"
   }

7. corroboration
   Also found by another lane (mde:openai-chatgpt)
   Detail

   {
     "findingKey": "mde:openai-chatgpt"
   }