Anthropic Excessive Chat Deletion

  1[metadata]
  2creation_date = "2026/09/15"
  3integration = ["anthropic"]
  4maturity = "production"
  5updated_date = "2026/09/21"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects an unusually high number of Claude chat deletion events for the same user email within a single calendar day.
 11Mass chat deletion can indicate an attempt to remove conversation history, cover tracks after misuse of Claude, or
 12automated cleanup following data staging or prompt abuse.
 13"""
 14false_positives = [
 15    """
 16    Users or administrators purging old chats during workspace hygiene, retention exercises, or GDPR-related cleanup can
 17    exceed the daily threshold legitimately.
 18    """,
 19]
 20from = "now-24h"
 21interval = "1h"
 22language = "esql"
 23license = "Elastic License v2"
 24name = "Anthropic Excessive Chat Deletion"
 25note = """## Triage and analysis
 26
 27### Investigating Anthropic Excessive Chat Deletion
 28
 29One mailbox deleted many chats in a UTC day bucket. Deleted content may no longer be viewable in the product UI —
 30preserve audit history early.
 31
 32Escalate when deletions follow uploads/exports/sharing, UA looks scripted, or compliance logging was disabled nearby.
 33Close as FP for scheduled retention cleanup or migration tooling with a ticket.
 34
 35#### Possible investigation steps
 36
 37- Capture chat/project ID values from the alert while they remain in audit history.
 38- Compare deletion volume to prior `claude_chat_created` / `claude_file_uploaded` from the same email — delete-after-
 39  upload is higher priority than cleanup of empty chats.
 40- Inspect IP/UA for scripted patterns; correlate with logging disablement, SSO changes, or data exports.
 41
 42### False positive analysis
 43
 44- Project closure cleanup and migration tooling often bulk-delete in one session.
 45
 46### Response and remediation
 47
 48- On malicious deletion: preserve remaining audit exports, revoke sessions, and investigate whether sensitive content
 49  was uploaded or shared before deletion.
 50"""
 51references = [
 52    "https://platform.claude.com/docs/en/api/compliance/activities/list",
 53]
 54risk_score = 47
 55rule_id = "2944223e-3c25-4ce4-bd69-64f2914da187"
 56severity = "medium"
 57tags = [
 58    "Domain: GenAI",
 59    "Platform: Anthropic",
 60    "Data Source: Anthropic Audit Logs",
 61    "Use Case: Threat Detection",
 62    "Use Case: UEBA",
 63    "Resources: Investigation Guide",
 64    "Rule Type: ES|QL",
 65    "Tactic: Defense Evasion",
 66]
 67timestamp_override = "event.ingested"
 68type = "esql"
 69
 70query = '''
 71from logs-anthropic.audit-*
 72| where
 73    data_stream.dataset == "anthropic.audit" and
 74    event.action == "claude_chat_deleted" and
 75    event.outcome == "success" and
 76    user.email is not null
 77| eval Esql.time_bucket = DATE_TRUNC(1 day, @timestamp)
 78| stats
 79    Esql.event_count = count(*),
 80    Esql.event_id_values = values(event.id),
 81    Esql.anthropic_audit_claude_chat_id_values = values(anthropic.audit.claude_chat_id),
 82    Esql.anthropic_audit_claude_project_id_values = values(anthropic.audit.claude_project_id),
 83    Esql.source_ip_values = values(source.ip),
 84    Esql.user_agent_original_values = values(user_agent.original),
 85    Esql.anthropic_audit_actor_type_values = values(anthropic.audit.actor.type),
 86    Esql.user_id_values = values(user.id),
 87    Esql.timestamp_first_seen = min(@timestamp),
 88    Esql.timestamp_last_seen = max(@timestamp)
 89  by user.email, Esql.time_bucket
 90| where Esql.event_count >= 30
 91| keep user.email, Esql.*
 92'''
 93
 94
 95[[rule.threat]]
 96framework = "MITRE ATT&CK"
 97[[rule.threat.technique]]
 98id = "T1070"
 99name = "Indicator Removal"
100reference = "https://attack.mitre.org/techniques/T1070/"
101
102
103[rule.threat.tactic]
104id = "TA0005"
105name = "Defense Evasion"
106reference = "https://attack.mitre.org/tactics/TA0005/"
107
108[rule.alert_suppression]
109group_by = ["user.email", "Esql.time_bucket"]
110duration = {value = 24, unit = "h"}
111missing_fields_strategy = "suppress"
112
113[rule.investigation_fields]
114field_names = [
115    "user.email",
116    "Esql.time_bucket",
117    "Esql.event_count",
118    "Esql.event_id_values",
119    "Esql.anthropic_audit_claude_chat_id_values",
120    "Esql.anthropic_audit_claude_project_id_values",
121    "Esql.source_ip_values",
122    "Esql.user_agent_original_values",
123    "Esql.anthropic_audit_actor_type_values",
124    "Esql.user_id_values",
125    "Esql.timestamp_first_seen",
126    "Esql.timestamp_last_seen",
127]