This rule detects the first observed decoded Apache Thrift RPC relationship initiated from a public (external) client address to a Thrift server, using a five-day history of new terms to surface the initial client/server pair that completes a decoded method invocation. It operates on logs from the thrift traffic dataset (logs-network_traffic.thrift-*), relying on a Thrift protocol analyzer integrated with Elastic Packet Capture. The alert is triggered when a new client IP (external) communicates with a server IP, and a Thrift method invocation is observed (service and method fields are populated). The rule highlights the decoded Thrift transaction as an indicator of exposure or potential abuse of a public Thrift endpoint, but it does not prove authentication bypass or exploitation. It is intended to aid network security monitoring by surfacing unusual external access patterns to Thrift services and guiding further investigation.