Anthropic SSO Disabled or Connection Removed

  1[metadata]
  2creation_date = "2026/09/12"
  3integration = ["anthropic"]
  4maturity = "production"
  5updated_date = "2026/09/21"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10SSO routes Anthropic authentication through the corporate identity provider. Disabling SSO, or deactivating or
 11deleting an SSO connection, moves users onto alternate sign-in paths where IdP-enforced MFA, conditional access, and
 12session policies no longer apply. That opens the door to password or magic-link accounts the attacker controls.
 13"""
 14false_positives = [
 15    """
 16    Identity provider directory sync and SCIM provisioning can deactivate or delete SSO connections during IdP
 17    migrations, directory attribute changes, or connector maintenance. If `anthropic.audit.actor.type` is
 18    `scim_directory_sync_actor`, correlate with WorkOS or Okta change windows before escalating.
 19    """,
 20    """
 21    Administrators deactivate or delete SSO connections during identity provider migrations, certificate rotation, or
 22    maintenance. Validate the actor, `anthropic.audit.connection_id`, and whether SSO was restored after the change.
 23    """,
 24]
 25from = "now-9m"
 26language = "esql"
 27license = "Elastic License v2"
 28name = "Anthropic SSO Disabled or Connection Removed"
 29note = """## Triage and analysis
 30
 31### Investigating Anthropic SSO Disabled or Connection Removed
 32
 33SSO is the primary path that enforces corporate IdP MFA and session policy. Turning SSO off, or deactivating/deleting
 34a connection, pushes users onto alternate sign-in (password / magic link) the attacker may control.
 35
 36Severity by action: `org_sso_connection_deleted` (must re-bind IdP) > `org_sso_connection_deactivated` >
 37`org_sso_toggled` with `anthropic.audit.enabled: false`.
 38
 39Unauthorized = no IdP change ticket / maintenance window for this `anthropic.audit.connection_id`, or a `user_actor`
 40change outside known admins, especially with sibling magic-link second-factor disablement or admin role grants.
 41SCIM-driven events during a documented connector sync are usually FP.
 42
 43#### Possible investigation steps
 44
 45- Branch on `anthropic.audit.actor.type`:
 46  - `scim_directory_sync_actor`: check `anthropic.audit.directory_id` / `workos_event_id` / `idp_connection_type`
 47    against IdP sync or certificate rotation windows before escalating.
 48  - `user_actor`: compare `user.email`, `source.ip`, and `user_agent.original` to expected admins; scripting UA or
 49    new IP is higher priority.
 50- Note `event.action`, `anthropic.audit.connection_id`, and `organization.id`. Check whether SSO was restored
 51  afterward.
 52- Correlate ±hours for magic link second factor changes, admin role grants, invites, or admin API key creation.
 53
 54### False positive analysis
 55
 56- IdP migrations often deactivate or delete a connection before the replacement is live — match ticket and restore.
 57
 58### Response and remediation
 59
 60- On unauthorized change: restore or reconfigure SSO immediately, then review accounts that authenticated while SSO
 61  was unavailable and rotate credentials for any suspicious successful logins in that window.
 62"""
 63references = [
 64    "https://platform.claude.com/docs/en/api/compliance/activities/list",
 65]
 66risk_score = 73
 67rule_id = "b0b81938-a2d3-4222-977b-56f9c81afcf7"
 68severity = "high"
 69tags = [
 70    "Domain: GenAI",
 71    "Domain: Identity",
 72    "Platform: Anthropic",
 73    "Data Source: Anthropic Audit Logs",
 74    "Use Case: Identity and Access Audit",
 75    "Use Case: Threat Detection",
 76    "Resources: Investigation Guide",
 77    "Rule Type: ES|QL",
 78    "Tactic: Defense Evasion",
 79]
 80timestamp_override = "event.ingested"
 81type = "esql"
 82
 83query = '''
 84from logs-anthropic.audit-* metadata _id, _version, _index
 85| where
 86    data_stream.dataset == "anthropic.audit" and
 87    mv_contains(event.category, "iam") and
 88    (
 89        event.action in ("org_sso_connection_deactivated", "org_sso_connection_deleted") or
 90        (event.action == "org_sso_toggled" and anthropic.audit.enabled == false)
 91    )
 92| keep _id, _version, _index, @timestamp, event.*, organization.*, user.*, source.*, user_agent.*, anthropic.audit.*, data_stream.*
 93'''
 94
 95
 96[[rule.threat]]
 97framework = "MITRE ATT&CK"
 98[[rule.threat.technique]]
 99id = "T1556"
100name = "Modify Authentication Process"
101reference = "https://attack.mitre.org/techniques/T1556/"
102
103
104[rule.threat.tactic]
105id = "TA0005"
106name = "Defense Evasion"
107reference = "https://attack.mitre.org/tactics/TA0005/"
108
109[rule.investigation_fields]
110field_names = [
111    "@timestamp",
112    "event.action",
113    "event.id",
114    "organization.id",
115    "anthropic.audit.connection_id",
116    "anthropic.audit.enabled",
117    "anthropic.audit.actor.type",
118    "anthropic.audit.actor.directory_id",
119    "anthropic.audit.actor.workos_event_id",
120    "anthropic.audit.actor.idp_connection_type",
121    "user.email",
122    "user.id",
123    "source.ip",
124    "user_agent.original",
125]