Detects creation or modification of a Codex security scan configuration via the OpenAI ChatGPT Enterprise integration. It monitors logs (logs-openai_chatgpt_enterprise.codex_security_log) for actions scan_configuration_created and scan_configuration_updated, extracting fields such as repository URL, scan_type, state, lookback_days, and context (user_id, user_email, client_id, workspace_id, scan_configuration_id). Changes to repository scope, lookback windows, or notification rules can weaken secrets-scanning coverage or redirect findings, representing potential defense evasion. The rule supports triage and containment by surfacing actor identity and configuration details for investigation. It is mapped to MITRE ATT&CK Defense Evasion (TA0005; T1562.001 - Disable or Modify Tools) and MITRE Atlas AML.T0081 (Modify AI Agent Configuration). Setup requires the OpenAI ChatGPT Enterprise data integration to feed compliance logs. References include Elastic’s OpenAI Enterprise integration docs and OpenAI compliance guidance.