# OpenAI

{% hint style="warning" %}
This integration is currently in Alpha. If you would like to get early access to test this integration, please get in touch with your Duo Care team, Duo Support, or open a Cisco TAC Case to have it enabled on your account. 
{% endhint %}

## Overview 

Cisco Identity Intelligence can integrate with OpenAI to gather data via their [OpenAI Compliance API](https://chatgpt.com/admin/api-reference#tag/Introduction) to surface users who have access to OpenAI models, how those models are being used, how they are configured and what tools they have access to. 

Using this data, Identity Intelligence can generate beneficial insights regarding the users and Non-Human Identities (NHIs) within OpenAI, such as improperly configured tools, improper use of tools, privilege escalation, data loss prevention, and more.  

### Requirements 

The following are necessary to configure the OpenAI integration: 

1. OpenAI Enterprise subscription 
2. OpenAI workspace(s) 
3. An OpenAI Enterprise Platform admin account capable of creating API keys 

### OpenAI API Permission Structure 

Identity Intelligence requests the minimal scopes necessary to complete the required operations to support the integration. For this integration, Identity Intelligence requires a \`read-only\` API token.  

<mark style="color:$warning;">**Note**</mark><mark style="color:$warning;">:</mark> The OpenAI Compliance API currently utilizes a coarse-grained permission structure that only supports either `read-only` or `read-write` permissions, and requires you to grant the API token permission to the whole API. It does not support granting a token access to limited portions of the API at this time.

### Managing Conversation Data Collection Preferences for ChatGPT & Codex&#x20;

The OpenAI Compliance API contains both conversation metadata and conversation logs regarding the conversations happening between end-users and your organization's instance of ChatGPT or Codex, which Identity Intelligence can retrieve via this integration. The conversation logs from these tools contain valuable data and information that Identity Intelligence can then analyze to generate and surface interesting insights about potential issues or risks associated with the OpenAI usage within your organization, such as detecting improper tool use or assisting with data loss prevention initiatives. \
\
However, we understand that this data may be sensitive and your org may not want, or allow, Identity Intelligence to retain conversation logs between your end-users and OpenAI models. For that reason, there are three setting options available that enable you to configure what conversation data Identity Intelligence is allowed to process so that you can select the preferred data handling method for your org.&#x20;

These three settings are:

1. **Do not collect ChatGPT or Codex conversation logs**
   1. Identity Intelligence will not retain **any** conversation metadata or logs &#x20;
2. ***\[Default Setting]*****&#x20;Collect conversation metadata only without conversation message content**
   1. Identity Intelligence will retain conversation log **metadata only**, but will not retain **any** fields that contain data regarding user prompts or model responses&#x20;
3. **Collect conversation metadata and conversation content**
   1. Identity Intelligence will collect and retain **full** conversation data, including **all** metadata, user prompts and model responses&#x20;

The following table depicts the different capabilities and functionality that Identity Intelligence can perform based on the available Conversation Log settings.

{% hint style="info" %}
Note: The insights and capabilities listed below may represent future functionality that will be developed for the General Availability release, or after, and do *not* have guaranteed availability during Alpha
{% endhint %}

<table data-full-width="false"><thead><tr><th width="303.3125"></th><th width="146.62109375" align="center" valign="top">Option 1: Do not collect ChatGPT or Codex conversation logs</th><th width="147.08203125" align="center" valign="top">Option 2: Collect conversation metadata only without conversation message content</th><th width="147.1953125" align="center" valign="top">Option 3: Collect conversation metadata &#x26; conversation content</th></tr></thead><tbody><tr><td>Baseline visibility  </td><td align="center" valign="top"><span data-gb-custom-inline data-tag="emoji" data-code="2705">✅</span></td><td align="center" valign="top"><span data-gb-custom-inline data-tag="emoji" data-code="2705">✅</span></td><td align="center" valign="top"><span data-gb-custom-inline data-tag="emoji" data-code="2705">✅</span></td></tr><tr><td>Account directory-based data and insights  <br><sub><em>Eg: Account activity, dormant accounts, admin privileges, etc.</em></sub></td><td align="center" valign="top"><span data-gb-custom-inline data-tag="emoji" data-code="2705">✅</span></td><td align="center" valign="top"><span data-gb-custom-inline data-tag="emoji" data-code="2705">✅</span></td><td align="center" valign="top"><span data-gb-custom-inline data-tag="emoji" data-code="2705">✅</span></td></tr><tr><td>GPT definition-based data and insights  <br><sub><em>Eg: Known risky tools, broadly defined tools, tools available to users who shouldn’t have access, etc.</em></sub>  </td><td align="center" valign="top"><span data-gb-custom-inline data-tag="emoji" data-code="2705">✅</span></td><td align="center" valign="top"><span data-gb-custom-inline data-tag="emoji" data-code="2705">✅</span></td><td align="center" valign="top"><span data-gb-custom-inline data-tag="emoji" data-code="2705">✅</span></td></tr><tr><td>Basic tool usage insights  <br><sub><em>Eg: Which tools were executed, what tool replied, etc.</em></sub>  </td><td align="center" valign="top"> </td><td align="center" valign="top"><span data-gb-custom-inline data-tag="emoji" data-code="2705">✅</span></td><td align="center" valign="top"><span data-gb-custom-inline data-tag="emoji" data-code="2705">✅</span></td></tr><tr><td>Deeper insights based on detailed conversation logs  <br><sub><em>Eg: Tool misuse, AI drift, data exfiltration, etc.</em></sub> </td><td align="center" valign="top"> </td><td align="center" valign="top"></td><td align="center" valign="top"><span data-gb-custom-inline data-tag="emoji" data-code="2705">✅</span></td></tr></tbody></table>

## OpenAI Configuration Steps&#x20;

{% hint style="info" %}
To configure this integration, OpenAI will first need to grant your organization custom Compliance API Scopes. This process, outlined in the OpenAI docs referenced in Step 1 (below), requires OpenAI support team involvement and may take **several days** depending on their availability and responsiveness.\
We encourage you to start this step as early as possible to avoid delays.  &#x20;
{% endhint %}

1. [Reference the **Authentication** section of the OpenAI docs](https://chatgpt.com/admin/api-reference#tag/Introduction) and follow the steps to obtain and save your API key. Copy down this this API key somewhere secure as you will needed it to complete the integration set up process in Identity Intelligence and you ***cannot*** generate the full API key again after it has been generated
   1. Make sure that you have created the API key under a **service account** and ***not*** as your own user or the integration will not work correctly &#x20;
2. Then navigate to the [**Organization Admin keys** setting page](https://platform.openai.com/settings/organization/admin-keys) and select **Create new admin key.** Give the key a name that is easy to recognize as linked to Identity Intelligence (eg: `Cisco Identity Intelligence Admin API Key`&#x20;
   1. Note: OpenAI does **not** provide the option to create an admin API key linked to a service account
3. Select **restricted** permissions and grant **read** **audit log scope** and **read organization administration scope**. The settings should look like this:

   <figure><img src="https://582105988-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqPSBzsjxd7KYg9DNVZ4l%2Fuploads%2F60JaxcsSOoT41iCkwHRq%2Funknown.png?alt=media&#x26;token=7990fe2b-0891-4498-b1e5-18a2a6ab6e68" alt="" width="365"><figcaption></figcaption></figure>
4. Once you have applied the correct permissions and scopes, select **Create Admin Key.** After you have successfully created the key, **make sure to save the secret value.** You will need this for later steps and you will **not** be able to see it again
5. Navigate to the [data controls settings](https://platform.openai.com/settings/organization/data-controls/data-retention) section in OpenAI and **enable audit logging**
6. Then, navigate to the [**Workspace Admin Settings**](https://chatgpt.com/admin) section in OpenAI. Review the workspace name to confirm that you have selected the correct workspace &#x20;
7. On the **Workspace Admin Settings** page, you will find an **Organization ID** and a **Workspace ID** (screenshot example below). Copy both of these down as you will need them to complete the integration set up process in Identity Intelligence&#x20;

<figure><img src="https://582105988-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqPSBzsjxd7KYg9DNVZ4l%2Fuploads%2FZGsncy3tyvvah0HXnddJ%2Funknown.png?alt=media&#x26;token=afa36807-b32e-4f7e-bbd9-38846a8d3019" alt="" width="563"><figcaption></figcaption></figure>

## Identity Intelligence Configuration Steps

After you have completed the OpenAI configuration steps outlined above, navigate to the **Integrations** page within your Identity Intelligence tenant and perform the following steps :&#x20;

1. From the **Integrations** page, select the **Add Integration** button. Locate and select **OpenAI Enterprise** from the list of possible integration sources&#x20;
2. Enter an easily recognizable display name for this integration (eg: `OpenAI <insert your org name>`). This display name will be used throughout Identity Intelligence to identify the integration among your other connected sources&#x20;
3. Enter the workspace ID and organization ID that you copied during Step 5 of the [OpenAI Configuration Steps](#openai-configuration-steps) section above into their respective fields&#x20;

<figure><img src="https://582105988-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqPSBzsjxd7KYg9DNVZ4l%2Fuploads%2F4NcW71kkviSn26fMVII1%2Funknown.png?alt=media&#x26;token=ab0da631-c0e2-42ec-89d9-b010205f3dbc" alt="" width="563"><figcaption></figcaption></figure>

4. Select the desired Conversation Log Collection setting &#x20;
   1. More detailed info on the available settings are provided above in the [Managing Conversation Data Collection Preferences](#managing-conversation-data-collection-preferences-for-chatgpt-and-codex) section&#x20;
5. Enter both the **Compliance** key and **Admin API** key generated previously in OpenAI into their respective fields
6. Select the **Connect** button to test the configuration connection&#x20;
7. Once the connection test is successful, navigate back to the main **Integrations** landing page, locate the OpenAI integration in your list of integrations. Select the **3-dot menu button** on right-hand side of the relevant row to open the menu, then select **Collect Now** to begin the OpenAI data ingestion process&#x20;

   6. <mark style="color:$warning;">**Note**</mark>: Data collection can take some time, depending on the size of your environment. We recommend giving data ingestion a few days to stabilize before closely examining the results

   &#x20;&#x20;

   <figure><img src="https://582105988-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqPSBzsjxd7KYg9DNVZ4l%2Fuploads%2FRCMHgaHrBPIsyU8Cnu75%2Funknown.png?alt=media&#x26;token=28cf4bd9-fc35-48c0-ac19-668880d03d28" alt="" width="563"><figcaption></figcaption></figure>