This rule detects OpenAI ChatGPT Enterprise Codex activity where a single user invokes a high number of distinct MCP tools across multiple connectors within a 30-minute window. Such broad tool and connector diversity can indicate compromised-account reconnaissance, unauthorized multi-system data collection, or automated enumeration of organizational data sources. The detection relies on OpenAI Codex log data (app_mcp_call events) and computes distinct counts of tools and connectors, bucketed by 30-minute intervals. It triggers when there are at least 10 distinct tools and at least 3 distinct connectors within the same time bucket, returning context such as the list of tool names and connector IDs, and first/last seen timestamps. The alert aligns with MITRE ATLAS techniques AML.T0053 (AI Agent Tool Invocation) and AML.TA0009 (Collection) and is tagged under GenAI/UEBA use cases. Setup guidance emphasizes configuring thresholds to reflect a baseline Codex usage and enabling the OpenAI ChatGPT Enterprise integration to collect codex logs. Triage guidance includes reviewing generated tool and connector values, validating whether the connectors are approved for the user or project, and inspecting nearby events (app_mcp_result, prompts, shares, and downloads) for the same user. Analysts should compare current activity to the user’s normal Codex tool diversity over time, and pivot to related account or session events to corroborate intent. False positives may arise from legitimate workloads where power users employ multiple approved connectors in a single Codex session; in such cases, raise thresholds above the baseline or implement an approved automation baseline. Remediation steps emphasize revoking unauthorized connectors or tokens, disabling suspicious integrations, and, if compromise is suspected, resetting sessions and conducting a broader credential-hrecon hunt. References include Elastic OpenAI ChatGPT Enterprise integration docs and OpenAI compliance guidance.