The rule OpenAI ChatGPT Enterprise Unusual MCP App Activity detects the first-time use of a ChatGPT Enterprise MCP (app_log.app_type: MCP) by a specific user (organization.id + user.email) within the rule history window. It targets new or unexpected MCP connectors that may move organizational data into third-party tools, rather than flagging routine traffic from approved connectors. The alert is generated when a first-seen combination of organization.id, user.email, and app_id is observed, with the app_name provided to give context for investigation. The detection uses a new_terms approach with a history window (now-10d) to identify genuinely new terms related to the organization, user, and app_id. This aligns with UEBA objectives by highlighting novel access patterns and potential data exposure via unmanaged integrations. The rule maps to MITRE ATT&CK (TA0009: Collection; T1213: Data from Information Repositories) and MITRE ATLAS AML.T0053 (AI Agent Tool Invocation). The rule requires OpenAI ChatGPT Enterprise logs to be collected into Elasticsearch and is designed to trigger triage steps when the app is not in the approved inventory, when the query suggests bulk data access, or when the user has recent suspicious authentication activity. Investigation should confirm app approval, review the app’s query and identifiers, and correlate with related app-auth events, conversation shares, or file downloads. False positives commonly include onboarding activity for approved MCP apps. Recommendations include disabling unauthorized MCP apps, revoking credentials, and reviewing context to prevent data exposure.