This rule detects suspicious discovery bursts using the OpenAI ChatGPT Enterprise Google Drive integration. It triggers when a single user issues five or more distinct Google Drive app searches within a five‑minute window, and at least one of those queries matches predefined sensitive-data themes (e.g., payroll, payslip, confidential, NDA, credentials, etc.). Implemented against the openai_chatgpt_enterprise.app_log dataset, it computes per-user, per-organization, time_bucket metrics: distinct query count, total event count, and a flag indicating the presence of sensitive terms. The alert fires when query_count_distinct >= 5 and sensitive_query_count >= 1. This pattern may indicate an attacker abusing a Drive connector after session compromise to locate high‑value files for exfiltration. MITRE ATT&CK mappings include T1213 (Data from Information Repositories) and T1083 (File and Directory Discovery) under Collection and Discovery. MITRE ATLAS mappings include AML.T0053 (AI Agent Tool Invocation) and AML.T0085 (Data from AI Services) under their respective tactics. False positives may arise from legitimate HR/legal/finance or vendor workflows performing multiple related searches; thresholds should be tuned for approved roles. Investigation steps include correlating with nearby chat or tool activity asking ChatGPT to search or download Drive files, and monitoring for post‑burst downloads, shares, or external forwarding. Remediation involves revoking the Google Drive connector if unauthorized, reviewing retrieved content, and following incident response procedures. The rule requires the OpenAI ChatGPT Enterprise integration to collect app_log events and is configured for a 30‑minute window with a 5‑minute bucket interval.