Detects bursts of login_failed events for the same user.email in the OpenAI ChatGPT Enterprise authentication logs, indicating potential password spraying or credential stuffing against enterprise accounts. The ES|QL rule aggregates events by user.email within a rolling window (now-1h, evaluated every 15m) and fires when the count reaches or exceeds 10. It collects supporting context (source IPs, geo country codes, and user agents) for investigation and maps to MITRE ATT&CK T1110 (Brute Force) under Credential Access. Alert suppression groups by user.email to reduce duplicates. The rule is labeled with medium severity and a risk score of 47, and requires the OpenAI ChatGPT Enterprise integration to feed compliance logs into Elasticsearch.