This rule detects suspicious Gmail connector activity performed via the OpenAI ChatGPT Enterprise integration, specifically Gmail app searches that resemble sensitive data discovery or collection. It analyzes Gmail app_log events (SERVICE) with flattened input fields to extract the user query and derive several booleans that indicate potential data exfiltration preparation or misuse. Signals include: (1) attachment_search when the query includes has:attachment, (2) document_extension when common document extensions (pdf, doc, xls, etc.) appear, (3) multiple_filetypes when multiple filename filters are present, and (4) matches for financial, HR, legal, or credentials keywords. The alert triggers when attachment searches align with document filters, or when any credential/financial/HR/legal term is found. This maps to collection and discovery behaviors typical of data reconnaissance prior to exfiltration. The rule flags suspicious Gmail discovery actions linked to the Gmail app within ChatGPT Enterprise and provides guidance for triage and remediation. It also ties to MITRE ATT&CK tactics such as Collection (TA0009) and Discovery (TA0007) with techniques T1213 and T1083, and MITRE ATLAS techniques AML.T0053 (AI Agent Tool Invocation) and AML.T0085 (Data from AI Services). The rule is configured with a medium severity and a risk_score of 47, reflecting potential exposure of sensitive content if abused. It requires the OpenAI ChatGPT Enterprise integration and access to app_log fields, including the flattened openai_chatgpt_enterprise.app_log.input (query). Setup instructions and references are included in the rule to assist in deployment, investigation, and response. A true positive is likely when a user’s Gmail search queries are broad and coupled with attachments, while false positives may occur for legitimate HR, legal, finance, or IR research conducted via approved Gmail access.