Detects an unusually high number of OpenAI ChatGPT Enterprise conversation_delete events by a single user within a rolling 24-hour window. Mass deletion can indicate attempts to erase conversation history or cover tracks after misuse. The rule aggregates events from the ChatGPT Enterprise audit_log and flags cases where the user deletes 20 or more conversations in 24 hours. It surfaces context such as user identifiers, timestamps, and related conversation IDs to support investigation. The rule maps to MITRE ATT&CK defense evasion techniques (Indicator Removal, T1070) and MITRE ATLAS AML.T0092 (Manipulate User LLM Chat History). It is intended for UEBA workflows and includes an investigation guide, false-positive considerations (e.g., retention cleanup or migration tooling), and remediation guidance (preserve audit exports, revoke sessions if activity appears malicious). Requires the OpenAI ChatGPT Enterprise integration to ingest compliance logs into Elasticsearch. Risk score 47; severity is medium.