The OpenAI ChatGPT Enterprise Custom Agent Trigger Changed rule detects creation or update events for custom agent triggers within the OpenAI ChatGPT Enterprise integration. Triggers can schedule or drive agent runs without interactive user presence, enabling persistence and automation abuse. The rule targets logs from the openai_chatgpt_enterprise.custom_agents_log data stream, specifically events where event.action is either "trigger_created" or "trigger_updated". It extracts the actor (user.id, user.email), agent (gen_ai.agent.id), client_id, and the trigger’s required_actions to support investigation and attribution. This mapping aligns with MITRE ATT&CK T1053 (Scheduled Task/Job) under Persistence, and MITRE ATLAS AML.T0081 (Modify AI Agent Configuration) under Persistence. The setup requires the OpenAI ChatGPT Enterprise integration to forward compliance logs to Elasticsearch. Analysts should investigate the actor, agent, and trigger configuration, verify the scope and potential actions, and correlate with related agent publish or connector events. False positives may arise from approved recurring operational workflows. Remediation includes deleting unauthorized triggers and reviewing recent agent runs for unexpected automation. The rule aids SOC teams in detecting and triaging potential abuse of automated agent execution and persistence mechanics, with a timestamp reference from event.ingested.