This rule detects when an OpenAI ChatGPT Enterprise audit log records a domain_create action, indicating a new domain has been added to the workspace boundary. The data source is the OpenAI Enterprise audit logs ingested into Elasticsearch (via the OpenAI ChatGPT Enterprise integration) and the query filters on logs where data_stream.dataset is openai_chatgpt_enterprise.audit_log and event.action equals "domain_create" to surface domain-boundary changes. Adding a new domain can broaden who is allowed to join or access the tenant and may establish persistence for attacker-controlled domains. The rule is tagged as a high-severity identity/IA audit finding and maps to MITRE ATT&CK T1098 (Account Manipulation) under Persistence (TA0003) and MITRE ATLAS AML.T0125 (Create Account) to aid investigation and threat modeling. Typical indicators include the actor (user.id, user.email), source IP, and details in action_data such as hostname, domains, and domain_id. Investigation should confirm ownership of the domain, whether a formal change request exists, and whether subsequent invites or ownership transfers occurred. Analysts should review other IAM changes by the same actor within a surrounding window. False positives include legitimate onboarding or merger-related domain additions that were approved. Responders should remove unauthorized domains, audit related invites, and rotate credentials for the actor if the change appears malicious. The rule requires the OpenAI ChatGPT Enterprise integration to feed compliance logs into Elasticsearch and uses the ES|QL-based rule type. The associated risk score is 73 with high severity, and the rule uses event.ingested as the timestamp override for correlation.