ChatGPT Enterprise App Auth

Connector authorization log (event_type = APP_AUTH_LOG)

#	Field	Type	Display name	Description
1	_time	DATE	Time
2	user	STRING	Account	e.g. user01@example.com
3	action	STRING	Action	link
4	app_name	STRING	App name	Declared by the type but not sent on any record observed
5	app_id	STRING	App ID	e.g. connector_00000000000000000000000000000000
6	link_id	STRING	Link ID	e.g. 00000000-0000-0000-0000-000000000000
7	src_ip	IP	Source IP	e.g. 10.0.0.10
8	src_country	COUNTRY	Source country	e.g. KR
9	src_city	STRING	Source city	e.g. Seoul
10	src_region	STRING	Source region	e.g. Seoul
11	src_asn	STRING	Source ASN	e.g. AS00000 Example Telecom
12	src_latitude	STRING	Source latitude	e.g. 37.5665
13	src_longitude	STRING	Source longitude	e.g. 126.9780
14	user_agent	STRING	User agent	e.g. Mozilla/5.0 (Windows NT 10.0; Win64; x64)
15	dst_host	STRING	Destination hostname	e.g. chatgpt.com
16	ja3	STRING	JA3	e.g. 00000000000000000000000000000000
17	ja4	STRING	JA4	e.g. t13d1516h2_8daaf6152771_02713d6af862
18	type	STRING	Event type	e.g. AUDIT_LOG
19	event_id	STRING	Event ID	e.g. 00000000-0000-0000-0000-000000000000
20	user_id	STRING	User ID	e.g. user-A1b2C3d4E5f6G7h8I9j0K1l2
21	actor_type	STRING	Actor type	ACCOUNT_USER, SERVICE_ACCOUNT
22	principal_id	STRING	Workspace ID	e.g. 00000000-0000-0000-0000-000000000000
23	principal_type	STRING	Workspace type	CHATGPT_WORKSPACE
24	file_id	STRING	Log file ID	e.g. eclf_0000000000000000000000000000000000
25	extra	MAP	Unmapped fields	Fields the API added that this schema does not name yet