Detects two or more successful OpenAI ChatGPT Enterprise logins for the same user.email within 24 hours from source IPs whose geo-locations are at least 1,000 km apart, implying travel at or above 800 km/h. The rule analyzes auth_log events from the OpenAI ChatGPT Enterprise integration, compares the first and last login geolocations, computes distance and time window, and derives implied travel speed. It requires at least two login events and two distinct country codes, then flags when distance >= 1000 km and calculated speed >= 800 km/h. Alerts are mapped to cloud/identity-related threat activity and are suppressed per user.email for 24 hours to reduce alert fatigue. The rule includes investigation guidance, false-positive caveats, and remediation steps when a distant sign-in is suspected or confirmed.