Detects the first-seen OpenAI ChatGPT Enterprise Codex MCP tool name used by a specific organization and user (organization.id + user.email) within the rule’s history window. Codex MCP tools can query external systems and pull organizational data into a Codex session. The rule triggers on a new tool name observed in a Codex MCP call (data_stream.dataset: openai_chatgpt_enterprise.codex_log, event.action: app_mcp_call) and requires organization.id, user.email, and gen_ai.tool.name to be present. By flagging first-seen tool names rather than every routine call, it highlights new or unexpected connectors that could indicate unauthorized data movement. The alert is designed to escalate when the tool/connector is not on the approved inventory, the actor is unexpected, or the same session shows credential exposure, broad file access, or unusual shares; false positives may occur during approved tool rollouts. The rule maps to MITRE ATT&CK TA0009 (Collection) via T1213 (Data from Information Repositories) and MITRE ATLAS AML.T0085 (Data from AI Services). It requires the OpenAI ChatGPT Enterprise integration to collect compliance logs into Elasticsearch. Triage steps include verifying the connector against inventory, reviewing nearby Codex events for secrets or token activity, and determining if the tool is legitimate for the user or team. Remediation involves disabling unauthorized connectors, revoking credentials, and reviewing data returned into the Codex session; if sensitive data was retrieved, initiate the data-incident process.