Above Security

Investigate insider threats

Category: Security
Primary Subcategory: Threat Detection & SIEM/XDR Monitoring

Integration details

Description

Above brings your identity-security data into ChatGPT. Ask in plain language to list open incidents and high-risk identities; inspect incident timelines, evidence, and insights; look up devices, monitored applications, and audit logs; and run investigative searches across your tenant. You can also triage from chat — set incident status, verdict, and resolution notes, or add an identity to the watch list. Access requires an Above Security account and is scoped to your role and company; read and write are governed by explicit OAuth consent.

Integration type: Plugin
Verification status: Not applicable
Platform: ChatGPT
Category: Security
Primary Subcategory: Threat Detection & SIEM/XDR Monitoring
Secondary Subcategories: None listed
Brand: Above Security
Access: Account required
First tracked: 2026-09-01
Tool count: 24
Geography: US

ChatGPT Plugin Discovery Score

ChatGPT Plugin discovery is coming soon

ChatGPT can surface a Plugin when it matches a user's request.Your Plugin Discovery Score measures how often yours appears.

No spam. Unsubscribe any time.

ChatGPT recommends Airtable when a user asks it to update a CRM. — ChatGPT surfaces Airtable because it matches the user's request.

Primary Subcategory

Competing in ChatGPT Threat Detection & SIEM/XDR Monitoring

View Category

Listed in alphabetical order

Primary Subcategory

Above SecurityComing soonGet notified

Tools

24 tools agents can invoke

Add an identity to the company Person-of-Interest watch list, or update its entry if it is already listed (idempotent). Pick a reason (new_hire, pip, final_warning, investigation, offboarding, other), optionally attach a note, and set the on-expiry action (auto_remove or keep_until_reviewed). Entries expire after a fixed 90 days. Requires an Admin role (HR/Legal/User/IT cannot call). Resolve an email to a UUID with get_identity_uuid first.
add_to_watchlist
Deep escalation search for broad investigative questions the direct entity tools cannot answer. Use this ONLY when the focused tools (get_identity_*, get_incident*, get_device/list_devices, get_applications/get_extensions, get_alerts, get_insights, list_high_risk_identities, query_audit_logs) genuinely cannot answer — questions that require searching and correlating raw user activity and events across the tenant (e.g. "has anyone exfiltrated data to personal cloud storage in the last month?", "which users accessed competitor sites and also touched sensitive files?"). This is the slow, heavyweight path: it triggers a background investigation that searches and correlates raw events end-to-end. Results are NOT returned inline by this tool. Calling it signals that you want to escalate; the deeper search runs in the background and its answer is delivered to this thread when ready. Do NOT call it for a question a direct tool can answer, and do NOT expect data back in the same turn. Disambiguation from global_search: use global_search for a FAST cross-entity lookup of already-known objects (find a specific identity, incident, device, or application by name/identifier); use search_discovery for a SLOW deep search that explores and correlates raw activity to answer an open-ended investigative question.
search_discovery
Resolve an email to its monitored identity, returning the identity's UUID, name, email, risk score, and type — or a not-found error if the email is not a monitored identity in this tenant. Returns no overview, incidents, devices, or observations.
get_identity_uuid
Get one device by UUID. Returns name, email, status, last-seen, created plus the linked identity (name, email, risk score) when associated.
get_device
Get the latest executive report or a specific one by UUID
get_executive_report
Get an identity's Identity 360 overview: risk score, risk tier, free-text observations, risk categories, linked devices, and incident COUNTS ONLY (total / open / critical). Does NOT return individual incident titles, descriptions, severities, or remediation steps.
get_identity_overview
Return recent event activity (chronological, newest first) for ONE identity by UUID. Returns paginated events with type/url/path/text/timestamp/important fields. Safe for HR/Legal roles (Identity-360 scope).
get_identity_activity
Get one identity's current risk score (numeric), risk tier, and last-updated timestamp. Returns no incident, device, or observation data.
get_identity_risk_score
Get the full detail of ONE incident by UUID: severity, status, verdict, type, the involved identity, executive summary, behavioral analysis, risk assessment, metrics, matrix tags, and an activity timeline. This is the authoritative source for what a specific incident involved.
get_incident
Return the chronological activity timeline for ONE incident by UUID. Includes events, actions, status transitions. Cheaper than refetching the full incident.
get_incident_timeline
Search across identities, incidents, applications, and browser extensions in this tenant. Returns sectioned results — each section has hits with name/uuid/score. Use when you have a name/email/incident-ID substring but not a UUID. Minimum 3 characters required (canonical incident IDs like 'INC-42' bypass the length check).
global_search
List browser extensions
get_extensions
List devices in this tenant (UUID, name, email, status, last-seen, created). Supports substring search across name/email/UUID, sort by createdAt|name|lastActivityAt, paginate. Use get_device for the per-device detail (incl. linked identity).
list_devices
List identities at HIGH or CRITICAL risk (UUID, name, email, risk score), optionally filtered by severity and limit. A tenant-wide ranked view of the riskiest identities.
list_high_risk_identities
List identities in this tenant with full filters (substring search across name/email/UUID, minimum risk score, sort, paginate). For 'just the risky ones' use list_high_risk_identities instead — this is the full browse.
list_identities
List all evidence items (screenshots, app context, uploaded files) attached to ONE incident by UUID. Each item includes its public download URL (presigned, time-limited).
get_incident_evidence
List incidents in this tenant (optionally filtered by severity, status, verdict, or type), returning each incident's summary fields (UUID, external id, severity, status, verdict, type, and the involved identity). Use get_incident for one incident's full detail.
get_incidents
List investigation insights and reports (optionally filtered by identity email, report type, year, or week number), returning report records and summaries. Does not return raw incident detail.
get_insights
List monitored applications (shadow IT)
get_applications
Query the company's portal audit log (who did what, when, from where). Admin/SystemAdmin only — non-admin keys will be rejected at the route layer with 403. Filters by action, date range, portal user, and limit (max 200).
query_audit_logs
Remove an identity from the company Person-of-Interest watch list. Returns a clear 'not_on_watch_list' result (not an error) when the identity was not flagged, so it is safe to call unconditionally. Requires an Admin role (HR/Legal/User/IT cannot call). Resolve an email to a UUID with get_identity_uuid first.
remove_from_watchlist
Set the resolution notes on an incident (free-form text, max 4000 chars). Note: this REPLACES the current notes — to extend existing notes, the caller is responsible for fetching them first via get_incident and concatenating. Requires non-restricted role.
set_incident_notes
Set an incident's verdict (Pending, Confirmed, FalsePositive, NeedsReview, Benign). Use this to record analyst judgement on whether an incident is a true positive or false positive. 'Benign' marks real, correctly-detected activity that is not concerning/acceptable — unlike FalsePositive it does not feed the false-positive training pipeline. Requires non-restricted role.
update_incident_verdict
Update an incident's status (Open, InProgress, Resolved, Dismissed, AutoResolved). Use this to triage incidents. The Hidden state cannot be set here — use the False Positive flow in the portal instead. Requires non-restricted role (HR/Legal cannot call).
update_incident_status

Above Security FAQ

How do I improve a ChatGPT Plugin's discoverability?

The levers are the listing surface agents actually read: names, descriptions, keywords, tool metadata, and registry health. Which lever matters depends on where discovery breaks, which is what continuous measurement shows.

Where is this profile measured?

This profile uses the geography attached to the latest public registry snapshot: US. Locale tags are intentionally omitted.