This rule detects OpenAI ChatGPT Enterprise workspace compliance log deletions, i.e., the deletion of a log file via the audit log action delete_workspace_log_file. It targets events from the openai_chatgpt_enterprise.audit_log dataset where the action is delete_workspace_log_file and the actor type is ACCOUNT_USER, indicating a user-initiated removal rather than an automated service process. The ES|QL query exposes key fields for investigation (timeline, who, where, and what log was deleted), including user.id, user.email, source.ip, event_type, and log_file_id. This aligns with defense evasion by removing evidence from compliance workflows or investigations and can be used to cover tracks after privileged activity. The rule maps to MITRE ATT&CK T1070 (Indicator Removal) and MITRE ATLAS AML.T0092 (Manipulate User LLM Chat History), reflecting a malicious aim to erase or hinder audit visibility within a cloud-based LLM environment. A setup note emphasizes that compliant ingestion of OpenAI ChatGPT Enterprise logs into Elasticsearch is required. Investigation guidance is provided (actor identity, correlate with list_workspace_log_files or download_workspace_log_file, check retention/policy tickets, review other privileged actions by the same actor), along with false positive considerations (authorized admin retention cleanup). Remediation guidance includes preserving exports, tightening deletion permissions, reviewing privileged activity, and revoking sessions or admin access if unauthorized. The rule’s risk score is 47 with a medium severity designation, and it includes MITRE-aligned mappings to aid cross-model detection and response planning.