This rule detects successful OpenAI ChatGPT Enterprise authentication events where the user agent is a scripted or non-browser client (e.g., Python, curl, Go HTTP clients, aiohttp, headless browsers, or scrapers). It ingests OpenAI ChatGPT Enterprise compliance/auth logs (data_stream.dataset = openai_chatgpt_enterprise.auth_log) and flags events where event.action includes login_success, native_login_success, or token_issued, and where user_agent.original is present and matches patterns indicating non-browser automation. The detection supports threat mapping to MITRE ATT&CK T1078 (Valid Accounts) and MITRE Atlas AML.T0012 (Valid Accounts), given that compromised or reused credentials may be used by automated tooling. False positives include approved automation, compliance tooling, or SSO libraries that legitimately use non-browser user agents. The rule provides triage steps, response guidance, and remediation suggestions (revoke sessions, rotate credentials, inventory automations using that user agent, and scrutinize subsequent data-access or admin activity). It requires the OpenAI ChatGPT Enterprise integration to collect compliance logs into Elasticsearch. The rule’s risk_score is 47 and severity is medium, and it is designed to trigger on scripted clients that could indicate credential abuse or account takeover when paired with unusual login behavior or privileged actions shortly after sign-in.