Anthropic Multiple Authentication Failures

  1[metadata]
  2creation_date = "2026/09/12"
  3integration = ["anthropic"]
  4maturity = "production"
  5updated_date = "2026/09/25"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects at least five failed Anthropic authentication events for the same user email within one hour. Failures are
 11matched by authentication category and failure outcome (for example magic-link or SSO login failures). That pattern fits
 12repeated guessing, stale magic link abuse, or automated login attempts against one account.
 13"""
 14false_positives = [
 15    """
 16    A user repeatedly clicking an expired or invalid magic link from the same browser session can produce several
 17    failures before requesting a new link or signing in successfully.
 18    """,
 19    """
 20    IdP or SSO cutover testing against a pilot account can generate a short burst of failed attempts for one email
 21    during maintenance windows.
 22    """,
 23]
 24from = "now-60m"
 25interval = "15m"
 26language = "esql"
 27license = "Elastic License v2"
 28name = "Anthropic Multiple Authentication Failures"
 29note = """## Triage and analysis
 30
 31### Investigating Anthropic Multiple Authentication Failures
 32
 33One mailbox produced a burst of authentication failures (magic-link, SSO, or other auth failures) within an hour.
 34Use IP diversity on the alert to separate focused retries from distributed automation.
 35
 36Escalate when many distinct IPs hit one email, failures precede a successful login from an unfamiliar IP, or SSO /
 37magic-link second-factor weakening sits nearby. Close as FP for expired magic-link retries from one IP/UA or IdP
 38pilot testing with a ticket.
 39
 40#### Possible investigation steps
 41
 42- Read `Esql.event_count`, `Esql.event_action_values`, `Esql.source_ip_values`, and
 43  `Esql.source_ip_distinct_count`.
 44- Low IP diversity → one device/egress (typos, expired links, focused guessing). High diversity → distributed
 45  automation or proxy rotation — higher priority.
 46- Inspect UA / actor-type values for automation. Search for successful `magic_link_login_succeeded` /
 47  `sso_login_succeeded` for the same email or IPs in the window.
 48- Correlate with **Anthropic SSO Disabled or Connection Removed** or magic-link second-factor disablement when
 49  org-scoped admin events are present.
 50
 51### False positive analysis
 52
 53- Expired magic-link click storms from one IP and named IdP cutover tests are common FPs.
 54
 55### Response and remediation
 56
 57- On suspected stuffing/takeover: invalidate sessions, reset credentials/MFA, and review successful logins from new
 58  IPs. If failures precede a successful unfamiliar login, expand to data access and admin changes.
 59"""
 60references = ["https://platform.claude.com/docs/en/api/compliance/activities/list"]
 61risk_score = 47
 62rule_id = "25647990-cc37-430c-9a4e-2793bb5445f5"
 63severity = "medium"
 64tags = [
 65    "Domain: GenAI",
 66    "Domain: Identity",
 67    "Platform: Anthropic",
 68    "Data Source: Anthropic Audit Logs",
 69    "Use Case: Identity and Access Audit",
 70    "Use Case: Threat Detection",
 71    "Use Case: UEBA",
 72    "Resources: Investigation Guide",
 73    "Rule Type: ES|QL",
 74    "Tactic: Credential Access",
 75]
 76timestamp_override = "event.ingested"
 77type = "esql"
 78
 79query = '''
 80from logs-anthropic.audit-*
 81| where
 82    data_stream.dataset == "anthropic.audit" and
 83    mv_contains(event.category, "authentication") and
 84    event.outcome == "failure" and
 85    user.email is not null
 86| stats
 87    Esql.event_count = count(*),
 88    Esql.event_id_values = values(event.id),
 89    Esql.event_action_values = values(event.action),
 90    Esql.source_ip_values = values(source.ip),
 91    Esql.source_ip_distinct_count = count_distinct(source.ip),
 92    Esql.user_agent_original_values = values(user_agent.original),
 93    Esql.anthropic_audit_actor_type_values = values(anthropic.audit.actor.type),
 94    Esql.timestamp_first_seen = min(@timestamp),
 95    Esql.timestamp_last_seen = max(@timestamp)
 96  by user.email
 97| where Esql.event_count >= 5
 98| keep user.email, Esql.*
 99'''
100
101
102[[rule.threat]]
103framework = "MITRE ATT&CK"
104[[rule.threat.technique]]
105id = "T1110"
106name = "Brute Force"
107reference = "https://attack.mitre.org/techniques/T1110/"
108
109
110[rule.threat.tactic]
111id = "TA0006"
112name = "Credential Access"
113reference = "https://attack.mitre.org/tactics/TA0006/"
114[[rule.threat_mappings]]
115framework = "MITRE ATLAS"
116version = "2026.08"
117[[rule.threat_mappings.threat]]
118framework = "MITRE ATLAS"
119
120[rule.threat_mappings.threat.tactic]
121id = "AML.TA0013"
122name = "Credential Access"
123reference = "https://atlas.mitre.org/tactics/AML.TA0013/"
124
125[rule.alert_suppression]
126group_by = ["user.email"]
127missing_fields_strategy = "suppress"
128
129[rule.investigation_fields]
130field_names = [
131    "user.email",
132    "Esql.event_count",
133    "Esql.event_id_values",
134    "Esql.event_action_values",
135    "Esql.source_ip_values",
136    "Esql.source_ip_distinct_count",
137    "Esql.user_agent_original_values",
138    "Esql.anthropic_audit_actor_type_values",
139    "Esql.timestamp_first_seen",
140    "Esql.timestamp_last_seen",
141]
142
143[rule.alert_suppression.duration]
144unit = "h"
145value = 1