Anthropic Organization Data Export Accessed

  1[metadata]
  2creation_date = "2026/09/12"
  3integration = ["anthropic"]
  4maturity = "production"
  5updated_date = "2026/09/21"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Starting an organization data export only signals intent. Accessing the export archive via its signed URL means the
 11actor actually downloaded chats, projects, user metadata, and configuration. An attacker with administrative access
 12can use this to exfiltrate intellectual property and credentials at scale.
 13"""
 14false_positives = [
 15    """
 16    Compliance, legal, and platform teams download organization data exports after scheduled audits, migrations, or
 17    litigation holds. Validate the actor and business justification before escalating.
 18    """,
 19]
 20from = "now-9m"
 21language = "esql"
 22license = "Elastic License v2"
 23name = "Anthropic Organization Data Export Accessed"
 24note = """## Triage and analysis
 25
 26### Investigating Anthropic Organization Data Export Accessed
 27
 28The export archive was downloaded (not merely requested). Reconstruct lifecycle with `org_data_export_started` /
 29`org_data_export_completed` for the same `organization.id`.
 30
 31Unauthorized = no legal/compliance/offboarding ticket, download without a matching started event or outside the
 32approved window, or export preceded by sudden admin grants / key creation / logging disablement.
 33
 34#### Possible investigation steps
 35
 36- Identify actor (`user_actor` → email/IP/UA) and whether a started/completed export exists for the same org.
 37- Flag downloads lacking a matching start, or occurring far from any approved hold/migration window.
 38- Correlate with admin role grants, admin API key creation, compliance logging changes, or SSO modifications.
 39- Determine whether the archive left approved storage or corporate networks (DLP / egress if available).
 40
 41### False positive analysis
 42
 43- Planned audit or offboarding exports include a download by authorized staff — ticket closes as FP.
 44
 45### Response and remediation
 46
 47- On unauthorized access: revoke admin for the actor, contain any copies of the archive, and review other admin
 48  changes in the same window.
 49"""
 50references = [
 51    "https://platform.claude.com/docs/en/api/compliance/activities/list",
 52]
 53risk_score = 73
 54rule_id = "00955b87-ed85-4977-8ab1-9140f85b9d6c"
 55severity = "high"
 56tags = [
 57    "Domain: GenAI",
 58    "Platform: Anthropic",
 59    "Data Source: Anthropic Audit Logs",
 60    "Use Case: Threat Detection",
 61    "Resources: Investigation Guide",
 62    "Rule Type: ES|QL",
 63    "Tactic: Collection",
 64    "Tactic: Exfiltration",
 65]
 66timestamp_override = "event.ingested"
 67type = "esql"
 68
 69query = '''
 70from logs-anthropic.audit-* metadata _id, _version, _index
 71| where
 72    data_stream.dataset == "anthropic.audit" and
 73    mv_contains(event.category, "file") and
 74    event.action == "org_data_export_accessed"
 75| keep _id, _version, _index, @timestamp, event.*, organization.*, user.*, source.*, user_agent.*, anthropic.audit.*, data_stream.*
 76'''
 77
 78
 79[[rule.threat]]
 80framework = "MITRE ATT&CK"
 81[[rule.threat.technique]]
 82id = "T1530"
 83name = "Data from Cloud Storage"
 84reference = "https://attack.mitre.org/techniques/T1530/"
 85
 86
 87[rule.threat.tactic]
 88id = "TA0009"
 89name = "Collection"
 90reference = "https://attack.mitre.org/tactics/TA0009/"
 91
 92[[rule.threat]]
 93framework = "MITRE ATT&CK"
 94[[rule.threat.technique]]
 95id = "T1567"
 96name = "Exfiltration Over Web Service"
 97reference = "https://attack.mitre.org/techniques/T1567/"
 98
 99
100[rule.threat.tactic]
101id = "TA0010"
102name = "Exfiltration"
103reference = "https://attack.mitre.org/tactics/TA0010/"
104
105[rule.investigation_fields]
106field_names = [
107    "@timestamp",
108    "event.action",
109    "event.id",
110    "organization.id",
111    "anthropic.audit.actor.type",
112    "user.email",
113    "user.id",
114    "source.ip",
115    "user_agent.original",
116]