Anthropic Compliance API Logging Disabled

  1[metadata]
  2creation_date = "2026/09/12"
  3integration = ["anthropic"]
  4maturity = "production"
  5updated_date = "2026/09/21"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Compliance API logging feeds the anthropic.audit dataset that Anthropic audit detections run on. An attacker with
 11administrative access can disable it so later role grants, API key creation, exports, and authentication changes stop
 12reaching this data source. This rule detects the disable action itself. Activity that happens after logging stops may
 13not appear in logs-anthropic.audit-*.
 14"""
 15false_positives = [
 16    """
 17    Platform or security administrators disable compliance logging during onboarding, integration testing, or log
 18    pipeline migrations. Verify the actor, source IP, and whether logging was re-enabled promptly. Planned changes can
 19    be exempted from this rule.
 20    """,
 21]
 22from = "now-9m"
 23language = "esql"
 24license = "Elastic License v2"
 25name = "Anthropic Compliance API Logging Disabled"
 26note = """## Triage and analysis
 27
 28### Investigating Anthropic Compliance API Logging Disabled
 29
 30Compliance API logging feeds `logs-anthropic.audit-*`. Disabling it creates a **blind window**: later admin actions
 31may not appear in this data source even if other logging remains. Do not assume the timeline after disable is complete.
 32
 33Unauthorized = no platform/security ticket for Fleet/integration work, and logging was not re-enabled promptly — or
 34disable is paired with role grants, key creation, exports, or SSO changes.
 35
 36#### Possible investigation steps
 37
 38- Confirm `anthropic.audit.compliance_api_logging_enabled == false`. Do not confuse with
 39  `compliance_api_enabled` (whether the Compliance API itself is on).
 40- Branch actor: `admin_api_key_actor` → which key (`anthropic.audit.actor.admin_api_key_id`); `user_actor` →
 41  email/IP/UA vs known admins.
 42- Pivot the same `organization.id` for admin grants, key creation, exports, or SSO changes **before** the disable
 43  (still visible) and note the blind window start time.
 44- Gate re-enable: treat the case as open until logging is back on and fresh events appear in `logs-anthropic.audit-*`.
 45
 46### False positive analysis
 47
 48- Integration testing / pipeline migrations can disable logging briefly — require a ticket and verify re-enable.
 49
 50### Response and remediation
 51
 52- Re-enable compliance API logging first and confirm ingestion resumes. Then reconstruct the blind window via any
 53  prior exports, Anthropic support, or other data sources, and review configuration changes around the disable.
 54"""
 55references = [
 56    "https://platform.claude.com/docs/en/api/compliance/activities/list",
 57    "https://www.elastic.co/docs/reference/integrations/anthropic",
 58]
 59risk_score = 73
 60rule_id = "4890f6d3-709f-440e-9135-d22403516ef7"
 61severity = "high"
 62tags = [
 63    "Domain: GenAI",
 64    "Platform: Anthropic",
 65    "Data Source: Anthropic Audit Logs",
 66    "Use Case: Log Auditing",
 67    "Use Case: Threat Detection",
 68    "Resources: Investigation Guide",
 69    "Rule Type: ES|QL",
 70    "Tactic: Defense Evasion",
 71]
 72timestamp_override = "event.ingested"
 73type = "esql"
 74
 75query = '''
 76from logs-anthropic.audit-* metadata _id, _version, _index
 77| where
 78    data_stream.dataset == "anthropic.audit" and
 79    mv_contains(event.category, "configuration") and
 80    event.action == "org_compliance_api_settings_updated" and
 81    anthropic.audit.compliance_api_logging_enabled == false
 82| keep _id, _version, _index, @timestamp, event.*, organization.*, user.*, source.*, user_agent.*, anthropic.audit.*, data_stream.*
 83'''
 84
 85
 86[[rule.threat]]
 87framework = "MITRE ATT&CK"
 88[[rule.threat.technique]]
 89id = "T1562"
 90name = "Impair Defenses"
 91reference = "https://attack.mitre.org/techniques/T1562/"
 92[[rule.threat.technique.subtechnique]]
 93id = "T1562.008"
 94name = "Disable or Modify Cloud Logs"
 95reference = "https://attack.mitre.org/techniques/T1562/008/"
 96
 97
 98
 99[rule.threat.tactic]
100id = "TA0005"
101name = "Defense Evasion"
102reference = "https://attack.mitre.org/tactics/TA0005/"
103
104[rule.investigation_fields]
105field_names = [
106    "@timestamp",
107    "event.action",
108    "event.id",
109    "organization.id",
110    "anthropic.audit.compliance_api_logging_enabled",
111    "anthropic.audit.compliance_api_enabled",
112    "anthropic.audit.actor.type",
113    "anthropic.audit.actor.admin_api_key_id",
114    "user.email",
115    "user.id",
116    "source.ip",
117    "user_agent.original",
118]