Anthropic Compliance Audit Log Export Accessed

  1[metadata]
  2creation_date = "2026/09/12"
  3integration = ["anthropic"]
  4maturity = "production"
  5updated_date = "2026/09/21"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10An audit log export archive was accessed, meaning the actor downloaded exported audit activity. Attackers pull audit
 11exports to see what defenders can observe, look for detection gaps, or remove evidence before making other control-plane
 12changes.
 13"""
 14false_positives = [
 15    """
 16    Security and compliance teams download audit log exports for investigations, regulatory requests, or SIEM
 17    validation. Validate the actor and confirm the activity matches an approved ticket.
 18    """,
 19]
 20from = "now-9m"
 21language = "esql"
 22license = "Elastic License v2"
 23name = "Anthropic Compliance Audit Log Export Accessed"
 24note = """## Triage and analysis
 25
 26### Investigating Anthropic Compliance Audit Log Export Accessed
 27
 28An audit-log export archive was downloaded. Attackers use this to see what defenders can observe or to stage before
 29further control-plane changes. Correlate with `audit_log_export_started` for the same org.
 30
 31Unauthorized = no security/compliance ticket, export window covering recent IAM/logging changes without investigation
 32context, or download followed by compliance logging disablement / SSO changes / data exports.
 33
 34#### Possible investigation steps
 35
 36- Use `anthropic.audit.from_date` / `to_date` to see which admin activity the actor pulled; match actor email/IP/UA to
 37  known IR/compliance staff.
 38- Find preceding `audit_log_export_started`. Flag if the window covers recent IAM or logging changes the actor then
 39  altered.
 40- Sequence check: download → logging disable / SSO change / org data export is a common recon-then-abuse pattern.
 41
 42### False positive analysis
 43
 44- SIEM validation and regulatory requests are expected — require an approved ticket.
 45
 46### Response and remediation
 47
 48- On unauthorized access: revoke actor access, determine whether export data left the org, and review whether
 49  compliance logging was disabled or modified around the same time.
 50"""
 51references = ["https://platform.claude.com/docs/en/api/compliance/activities/list"]
 52risk_score = 47
 53rule_id = "754f378f-5828-4ab7-ba3c-01ad4365b474"
 54severity = "medium"
 55tags = [
 56    "Domain: GenAI",
 57    "Platform: Anthropic",
 58    "Data Source: Anthropic Audit Logs",
 59    "Use Case: Threat Detection",
 60    "Resources: Investigation Guide",
 61    "Rule Type: ES|QL",
 62    "Tactic: Collection",
 63]
 64timestamp_override = "event.ingested"
 65type = "esql"
 66
 67query = '''
 68from logs-anthropic.audit-* metadata _id, _version, _index
 69| where
 70    data_stream.dataset == "anthropic.audit" and
 71    mv_contains(event.category, "file") and
 72    event.action == "audit_log_export_accessed"
 73| keep _id, _version, _index, @timestamp, event.*, organization.*, user.*, source.*, user_agent.*, anthropic.audit.*, data_stream.*
 74'''
 75
 76
 77[[rule.threat]]
 78framework = "MITRE ATT&CK"
 79[[rule.threat.technique]]
 80id = "T1530"
 81name = "Data from Cloud Storage"
 82reference = "https://attack.mitre.org/techniques/T1530/"
 83
 84
 85[rule.threat.tactic]
 86id = "TA0009"
 87name = "Collection"
 88reference = "https://attack.mitre.org/tactics/TA0009/"
 89
 90[rule.investigation_fields]
 91field_names = [
 92    "@timestamp",
 93    "event.action",
 94    "event.id",
 95    "organization.id",
 96    "anthropic.audit.from_date",
 97    "anthropic.audit.to_date",
 98    "anthropic.audit.actor.type",
 99    "user.email",
100    "user.id",
101    "source.ip",
102    "user_agent.original",
103]