ChatGPT Enterprise Authentication

Sign-in and role change log (event_type = AUTH_LOG)

#	Field	Type	Display name	Description
1	_time	DATE	Time
2	user	STRING	Account	e.g. user01@example.com
3	action	STRING	Action	e.g. token_issued. Carried inside action_data, not at the top level.
4	role	STRING	Role	e.g. account-admin. Carried inside action_data.
5	src_ip	IP	Source IP	e.g. 10.0.0.10
6	src_country	COUNTRY	Source country	e.g. KR
7	src_city	STRING	Source city	e.g. Seoul
8	src_region	STRING	Source region	e.g. Seoul
9	src_asn	STRING	Source ASN	e.g. AS00000 Example Telecom
10	src_latitude	STRING	Source latitude	e.g. 37.5665
11	src_longitude	STRING	Source longitude	e.g. 126.9780
12	auth_provider	STRING	Authentication provider	Declared by the type but not sent on any record observed
13	result	STRING	Result	Declared by the type but not sent on any record observed
14	user_agent	STRING	User agent	e.g. Mozilla/5.0 (Windows NT 10.0; Win64; x64)
15	dst_host	STRING	Destination hostname	e.g. chatgpt.com
16	ja3	STRING	JA3	e.g. 00000000000000000000000000000000
17	ja4	STRING	JA4	e.g. t13d1516h2_8daaf6152771_02713d6af862
18	type	STRING	Event type	e.g. AUDIT_LOG
19	event_id	STRING	Event ID	e.g. 00000000-0000-0000-0000-000000000000
20	user_id	STRING	User ID	e.g. user-A1b2C3d4E5f6G7h8I9j0K1l2
21	actor_type	STRING	Actor type	ACCOUNT_USER, SERVICE_ACCOUNT
22	principal_id	STRING	Workspace ID	e.g. 00000000-0000-0000-0000-000000000000
23	principal_type	STRING	Workspace type	CHATGPT_WORKSPACE
24	file_id	STRING	Log file ID	e.g. eclf_0000000000000000000000000000000000
25	extra	MAP	Unmapped fields	Fields the API added that this schema does not name yet