Detects successful OpenAI ChatGPT Enterprise audit_log events where a new user is invited to a workspace (invite_send with success). This can indicate an attacker who compromised an administrator inviting a mailbox they control to gain durable access. The rule surfaces details such as the actor, invitee email, invited role, and source IP, enabling investigators to assess legitimacy and follow-up activity. It maps to MITRE ATT&CK T1136 (Create Cloud Account) and AML.T0125 (Create Account) to identify persistence via account creation. It is configured to escalate when the invitee domain is unexpected, the invited role is privileged, or the actor is unusual; routine onboarding invites should be dismissed as false positives with an approved request. The rule requires the OpenAI ChatGPT Enterprise integration to feed compliance logs into Elasticsearch. Monitor triage guidance includes verifying invitee domain against trusted corporate domains, inspecting the actor’s privileges, checking for near-invite domain changes, and confirming whether the invite was accepted and followed by other suspicious activity. Remediation includes revoking unauthorized invites, removing the user if accepted, and rotating admin credentials.