Detects ten or more distinct Slack app search queries performed via the OpenAI ChatGPT Enterprise Slack integration within a five-minute window for a single user. It relies on ingestion of openai_chatgpt_enterprise.app_log events with app_name Slack, log_type request, non-null query and user.email, then buckets by 5-minute intervals and counts distinct query values. When the distinct query count reaches 10, it raises a detection that may indicate enumeration of Slack channels or messages in preparation for data collection or exfiltration after session compromise. The rule includes investigation steps (check Esql.query_values, correlate with chat prompts, check downloads or shares, verify approved Slack connector usage), false positives guidance (legitimate triage automation or support searches; adjust threshold accordingly), and remediation guidance (revoke access, review retrieved content, hunt for follow-on activity).