Detects OpenAI ChatGPT Enterprise user activity for the same email across multiple geographies and user agents within a four-hour window, by aggregating compliance-logs data from the OpenAI integration in Elasticsearch. The rule requires the same user.email to appear with at least three distinct source.geo.country_iso_code values and at least two distinct user_agent.original values, computing First/Last seen timestamps and counts per user. When the thresholds are met, it emits an alert with the user’s email and the collected Esql.* fields. This pattern can indicate session reuse, token abuse, or shared-account access through geographically distant egress points, including scenarios where no new authentication event is logged (e.g., stolen session cookies). It is not limited to authentication logs and relies on a combination of IPs, countries, and user agents across compliance data streams. The rule is high-severity (risk_score 99) and maps to credential-access and initial-access techniques in MITRE ATT&CK and MITRE ATLAS, reflecting potential misuse of valid cloud accounts and session credentials. Setup requires enabling the OpenAI ChatGPT Enterprise integration to feed compliance logs into Elasticsearch. Escalation guidance includes corroborating geo and user-agent inconsistencies, reviewing for VPN/proxy splits, and validating with user travel or VPN usage before escalation. Triage notes emphasize checking for remote exports or privileged actions from distant IPs, and triggering containment actions (logout, session revocation, credential resets) if compromise is suspected. False positives commonly arise from split-tunnel/VPN configurations or dual-homed cloud egress producing multi-region appearances in a short window.