This rule detects when the OpenAI ChatGPT Enterprise Gmail integration logs a Gmail action of sending an email via the Gmail connector (send_email). Drafts are explicitly excluded to focus on actual outbound mail. It relies on the OpenAI ChatGPT Enterprise integration’s application log (openai_chatgpt_enterprise.app_log) and requires the log output to include a Gmail action_name, such as 'send_email'. The rule extracts the action name from the log (field_extract on openai_chatgpt_enterprise.app_log.output) and filters for send_email. When matched, the rule emits identifiers and context (user.id, user.email, Esql.gmail_action, app_name, app_type, log_type, output, and data_stream metadata) to aid investigation. The intent is to detect abuse where an adversary, after compromising a session or the connected Gmail workflow, uses the Gmail connector to exfiltrate data or perform lateral phishing by sending mail on behalf of the user. The rule maps to exfiltration and lateral movement techniques and includes MITRE ATLAS and ATT&CK references. Investigators should validate whether the Gmail connector use and outbound mail are approved for that user, and correlate with preceding Gmail requests (subject/body/to) and nearby Gmail discovery, Drive activity, or unusual authentication events. False positives occur when legitimate, approved outbound mail is sent through the Gmail connector. Remediation steps include revoking Gmail connector access if unauthorized, reviewing sent mail contents per incident response playbooks, and hunting for additional sends or sensitive Gmail/Drive activity in the surrounding window. Setup notes indicate that successful detection requires the integration to capture Gmail app_log response events where openai_chatgpt_enterprise.app_log.output includes response.action_name (e.g., send_email). References include Elastic integration documentation and OpenAI compliance guidance.