Detects a high volume of OpenAI ChatGPT Enterprise file download audit events for a single user within a rolling 24-hour window. Implemented with ESQl, the rule aggregates events by user (user.id, user.email) and captures associated file identifiers, formats, source IPs, and first/last seen timestamps. It triggers when the 24-hour event count reaches 30 or more, flagging potential staging of conversation attachments or workspace files for exfiltration. The rule maps to MITRE ATT&CK T1567 Exfiltration Over Web Service and MITRE ATLAS AML.T0025 Exfiltration via Cyber Means. Alert suppression by user.id for 24 hours helps reduce noise. Triage guidance focuses on correlating file IDs, nearby conversation/share activity, source IP/geo/user agent baseline, and the storage or forwarding path of downloaded content. False positives include legitimate bulk downloads for research, migration, or e-discovery. Remediation includes suspending access if unauthorized, inventorying downloaded content, revoking sessions, and reviewing related exfiltration-oriented activity by the same user.