Pack Contributors:
- Sameh El-Hakim
- NVISO
Contributions are welcome and appreciated. For more info, visit our Contribution Guide.
OpenAI
- Details
- Content
- Dependencies
- Version History
The OpenAI API can be applied to virtually any task that involves understanding or generating natural language or code.
Pack Contributors:
- Sameh El-Hakim
- NVISO
Contributions are welcome and appreciated. For more info, visit our Contribution Guide.
Integrations
| Name | Description |
|---|---|
| OpenAI GPT | This integration assists security professionals with security investigations, threat hunting, and anomaly detection by leveraging OpenAI GPT models' natural language conversation capabilities. |
| OpenAI (Deprecated) | Deprecated. Use |
Integrations
| Name | Description |
|---|---|
| OpenAI GPT | This integration assists security professionals with security investigations, threat hunting, and anomaly detection by leveraging OpenAI GPT models' natural language conversation capabilities. |
| OpenAI (Deprecated) | Deprecated. Use |
Modeling Rules
| Name | Description |
|---|---|
OpenAI Modeling Rule |
Required Content Packs (1)
| Pack Name | Pack By |
|---|---|
| Base | By: Cortex XSOAR |
Optional Content Packs (0)
| Pack Name | Pack By |
|---|
All level dependencies (1)
| Pack Name | Pack By |
|---|---|
| Base | By: Cortex XSOAR |
2.1.1 - 10411205 (June 23, 2026)
- 44588
Download
Integrations
OpenAI GPT
- Added the gpt-create-response command to send messages via the OpenAI Responses API. Supports multi-turn conversations, reasoning effort control for o-series and gpt-5 models, and background execution with polling.
- Added the gpt-analyze-email-header command to analyze email headers for potential security issues using the OpenAI Responses API.
- Added the gpt-analyze-email-body command to analyze email body content for potential security risks using the OpenAI Responses API.
- Added the gpt-draft-soc-email command to draft SOC email templates using the OpenAI Responses API with prior conversation context.
- Added the gpt-list-models command to list all models available to the configured API key.
- Added the gpt-create-moderation command to run text or images through the OpenAI Moderations API and return per-category flagging results.
- 44588
Download
2.0.8 - 9460622 (May 27, 2026)
- 44252
Download
Integrations
OpenAI GPT
- Added support for fetching OpenAI Audit logs (Admin API) and Compliance logs (ChatGPT Platform) as Cortex events.
- Reorganized the configuration sections: Connect for OpenAI Platform settings (
api.openai.com) and Connect - Compliance for ChatGPT Platform settings (api.chatgpt.com). - Updated the Docker image to: demisto/parse-emails:0.1.48.8794134.
- 44252
Download
2.0.4 - R5469292 (October 20, 2025)
2.1.3 - 11158821 (July 19, 2026)
- 45116
Download
Modeling Rules
OpenAI Modeling Rule
Fixed an issue where xdm.target.resource.name was not mapped for authentication events (login/logout) in the openai_admin_audit_raw dataset, leaving auth_target empty in the Authentication Story. Mapped xdm.target.resource.name to OpenAI API Platform for the login.succeeded, login.failed, logout.succeeded, and logout.failed events.
(Available from Cortex XSIAM 2.1.0).
- 45116
Download
2.1.2 - 10488545 (June 26, 2026)
- 44762
Download
Modeling Rules
OpenAI Modeling Rule
Fixed an issue where audit and compliance log fields were not properly mapped to the Cortex XDM schema:
- Mapped xdm.auth.service to SP in the openai_admin_audit_raw and openai_chatgpt_compliance_raw datasets.
- Mapped xdm.target.resource.name to OpenAI API Platform for authentication events.
- Updated xdm.event.outcome_reason to use the raw vendor error code for failed authentication events.
- Aligned the SaaS audit mapping of xdm.source.user.username, xdm.source.user.identifier, xdm.source.user.identity_type, xdm.target.resource.name, xdm.target.resource.id, xdm.observer.type, and xdm.observer.sub_type with the data model requirements.
(Available from Cortex XSIAM 2.1.0).
- 44762
Download
2.1.1 - 10411205 (June 23, 2026)
- 44588
Download
Integrations
OpenAI GPT
- Added the gpt-create-response command to send messages via the OpenAI Responses API. Supports multi-turn conversations, reasoning effort control for o-series and gpt-5 models, and background execution with polling.
- Added the gpt-analyze-email-header command to analyze email headers for potential security issues using the OpenAI Responses API.
- Added the gpt-analyze-email-body command to analyze email body content for potential security risks using the OpenAI Responses API.
- Added the gpt-draft-soc-email command to draft SOC email templates using the OpenAI Responses API with prior conversation context.
- Added the gpt-list-models command to list all models available to the configured API key.
- Added the gpt-create-moderation command to run text or images through the OpenAI Moderations API and return per-category flagging results.
- 44588
Download
2.1.0 - 10224262 (June 16, 2026)
- 44619
Download
Modeling Rules
New: OpenAI Modeling Rule
New: Added a new modeling rule OpenAI Modeling Rule that maps the openai_admin_audit_raw and openai_chatgpt_compliance_raw datasets to the Cortex XDM schema, supporting the Authentication and SaaS Security stories.
(Available from Cortex XSIAM 2.1.0).
- 44619
Download
2.0.8 - 9460622 (May 27, 2026)
- 44252
Download
Integrations
OpenAI GPT
- Added support for fetching OpenAI Audit logs (Admin API) and Compliance logs (ChatGPT Platform) as Cortex events.
- Reorganized the configuration sections: Connect for OpenAI Platform settings (
api.openai.com) and Connect - Compliance for ChatGPT Platform settings (api.chatgpt.com). - Updated the Docker image to: demisto/parse-emails:0.1.48.8794134.
- 44252
Download
2.0.4 - R5469292 (October 20, 2025)
PUBLISHER
PLATFORMS
Cortex XSOARCortex XSIAM
INFO
| Certification | Certified | Read more |
| Supported By | Cortex | |
| Created | December 7, 2022 | |
| Last Release | July 24, 2026 |
WORKS WITH THE FOLLOWING INTEGRATIONS:
