This rule detects OpenAI ChatGPT Enterprise workspace compliance log file access. It triggers when an ACCOUNT_USER lists or downloads workspace compliance log files via the OpenAI ChatGPT Enterprise integration, potentially exposing authentication events, conversations, and Codex activity. The detection is implemented as an ESQuery over logs-openai_chatgpt_enterprise.audit_log-* where event.action is either 'download_workspace_log_file' or 'list_workspace_log_files' and the actor.type is 'ACCOUNT_USER'. The returned fields support triage, including timestamp, user.id/email, source.ip, event_type, log_file_id, privilege, actor.type, and related data_stream metadata. Investigators can correlate this activity with other privileged events (role changes, invites, feature toggles) in the same window to differentiate legitimate admin actions from suspicious access. The rule maps to MITRE ATT&CK TA0009 (Collection) via T1530 (Data from Cloud Storage) and to MITRE ATLAS AML.T0085 (Data from AI Services). Investigation fields prioritize key identifiers for follow-up. False positives include legitimate administrative or compliance/export activities performed under approved workflows. Recommendations emphasize containment and verification: escalate when the actor is unexpected or downloads coincide with privileged changes; remediation includes revoking unauthorized sessions, determining whether data left the environment, auditing other exports by the same actor, and tightening access to workspace logs.