Anthropic Organization IP Restriction Deleted

  1[metadata]
  2creation_date = "2026/09/12"
  3integration = ["anthropic"]
  4maturity = "production"
  5updated_date = "2026/09/21"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Organization IP restrictions limit Anthropic administrative access to approved network ranges. Deleting one widens
 11where a compromised admin session or API key can be used. The audit event does not always carry the deleted CIDR or
 12restriction identifier, so treat this as an early signal and pivot to nearby IP restriction create or update events
 13for the same organization.
 14"""
 15false_positives = [
 16    """
 17    Network or security teams remove IP restrictions during office moves, VPN migrations, or policy redesigns.
 18    Validate the actor, and confirm replacement restrictions were applied if the control is still required.
 19    """,
 20]
 21from = "now-9m"
 22language = "esql"
 23license = "Elastic License v2"
 24name = "Anthropic Organization IP Restriction Deleted"
 25note = """## Triage and analysis
 26
 27### Investigating Anthropic Organization IP Restriction Deleted
 28
 29IP allowlists limit where admin sessions and admin API keys can be used. Deleting a restriction widens that surface.
 30The delete event often lacks the removed CIDR — recover it from nearby create/update events.
 31
 32Unauthorized = no network/security change ticket for allowlist work, no replacement `org_ip_restriction_created` /
 33`org_ip_restriction_updated` in the same window, or deletion paired with admin key creation / SSO weakening.
 34
 35#### Possible investigation steps
 36
 37- Identify actor type. For `user_actor`, check admin identity via `user.email`, `source.ip`, and UA. For
 38  `anthropic_actor`, pivot on `organization.id` only.
 39- Search the same org for `org_ip_restriction_created` / `org_ip_restriction_updated` before/after the delete to
 40  recover ranges and see if this was a replace vs a standalone removal.
 41- Correlate ±hours for admin role grants, admin API key creation, SSO changes, or data exports — common follow-ons
 42  after network controls drop.
 43- Close as FP when a ticket names the migration and a replacement restriction appears promptly. Escalate when deletion
 44  stands alone or admin activity from non-corporate IPs follows.
 45
 46### False positive analysis
 47
 48- Office moves and VPN redesigns often remove old ranges before new ones are applied.
 49
 50### Response and remediation
 51
 52- On unauthorized deletion: restore required IP restrictions, review admin activity from non-corporate `source.ip`
 53  during the open window, and rotate admin credentials / API keys used in that period.
 54"""
 55references = [
 56    "https://platform.claude.com/docs/en/api/compliance/activities/list",
 57]
 58risk_score = 73
 59rule_id = "ae472523-3854-4b2b-868d-a001c764a136"
 60severity = "high"
 61tags = [
 62    "Domain: GenAI",
 63    "Platform: Anthropic",
 64    "Data Source: Anthropic Audit Logs",
 65    "Use Case: Identity and Access Audit",
 66    "Use Case: Threat Detection",
 67    "Resources: Investigation Guide",
 68    "Rule Type: ES|QL",
 69    "Tactic: Defense Evasion",
 70]
 71timestamp_override = "event.ingested"
 72type = "esql"
 73
 74query = '''
 75from logs-anthropic.audit-* metadata _id, _version, _index
 76| where
 77    data_stream.dataset == "anthropic.audit" and
 78    mv_contains(event.category, "configuration") and
 79    event.action == "org_ip_restriction_deleted"
 80| keep _id, _version, _index, @timestamp, event.*, organization.*, user.*, source.*, user_agent.*, anthropic.audit.*, data_stream.*
 81'''
 82
 83
 84[[rule.threat]]
 85framework = "MITRE ATT&CK"
 86[[rule.threat.technique]]
 87id = "T1562"
 88name = "Impair Defenses"
 89reference = "https://attack.mitre.org/techniques/T1562/"
 90[[rule.threat.technique.subtechnique]]
 91id = "T1562.007"
 92name = "Disable or Modify Cloud Firewall"
 93reference = "https://attack.mitre.org/techniques/T1562/007/"
 94
 95
 96
 97[rule.threat.tactic]
 98id = "TA0005"
 99name = "Defense Evasion"
100reference = "https://attack.mitre.org/tactics/TA0005/"
101
102[rule.investigation_fields]
103field_names = [
104    "@timestamp",
105    "event.action",
106    "event.id",
107    "organization.id",
108    "anthropic.audit.actor.type",
109    "user.email",
110    "user.id",
111    "source.ip",
112    "user_agent.original",
113]