This rule detects OpenAI ChatGPT Enterprise Codex access token creation events from the Codex logs (logs-openai_chatgpt_enterprise.codex_log-*). When event.action equals "access_token_created", the alert surfaces critical fields such as token_id, token_name, client_id, user.id, user.email, and expires_at. Codex access tokens enable automated CLI or environment access and can be abused for persistence or lateral automation after account compromise. Tokens with no expires_at are treated as higher priority during triage. The rule maps to MITRE ATT&CK T1098 (Account Manipulation) under Persistence, and to MITRE ATLAS AML.T0083 (Credentials from AI Agent Configuration) under Credential Access. The setup requires the OpenAI ChatGPT Enterprise integration to collect compliance logs into Elasticsearch. The rule’s risk_score is 47 and its severity is medium. The query returns token-related fields and context (data_stream, timestamps) to support investigations. The rule is designed to trigger on token creation events within a nine-minute ingestion window, aligning with event.ingested timestamps.