Anthropic Excessive Chat Access Failures

  1[metadata]
  2creation_date = "2026/09/12"
  3integration = ["anthropic"]
  4maturity = "production"
  5updated_date = "2026/09/21"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects a single authenticated user generating an unusually high number of denied Claude chat access attempts in a
 1124-hour window. That pattern fits automated chat enumeration or attempts to reach conversations outside the actor's
 12permissions. Unauthenticated shared-link actors lack user.id and are excluded.
 13"""
 14false_positives = [
 15    """
 16    Users browsing many stale or revoked shared chat links during incident response or legal review can produce bursts
 17    of access failures. Confirm whether the activity matches an approved investigation before escalating.
 18    """,
 19]
 20from = "now-24h"
 21interval = "1h"
 22language = "esql"
 23license = "Elastic License v2"
 24name = "Anthropic Excessive Chat Access Failures"
 25note = """## Triage and analysis
 26
 27### Investigating Anthropic Excessive Chat Access Failures
 28
 29Alert keys: `user.id`, `organization.id`, and `source.ip` (plus `user.email` when present). The rule aggregates ≥20
 30`claude_chat_access_failed` events for one authenticated user in that org/IP over 24 hours. Unauthenticated
 31shared-link failures lack `user.id` and are out of scope.
 32
 33True positive: high failure-to-`claude_chat_viewed` ratio, sequential/patterned chat IDs, scripting UA. False
 34positive: legal/IR link review or broken bookmarks with scattered IDs and many successful views nearby.
 35
 36#### Possible investigation steps
 37
 38- Start from the alert keys (`user.id` / `organization.id` / `source.ip`) and the time window; pivot raw
 39  `claude_chat_access_failed` events.
 40- Review chat ID lists: sequential or patterned IDs suggest enumeration; scattered IDs fit shared-link browsing.
 41- Compare failure volume to `claude_chat_viewed` from the same actor. High failure-to-success ratio → enumeration.
 42- Check UA/automation signals and whether any failed chat IDs later succeed. Correlate with IAM/SSO/compliance key
 43  changes in the same period.
 44
 45### False positive analysis
 46
 47- Large revoked-link reviews and retrying expired URLs are FP when IDs are scattered and many `claude_chat_viewed`
 48  successes sit nearby (legal/IR ticket optional corroboration).
 49
 50### Response and remediation
 51
 52- On confirmed enumeration: revoke sessions, review recently accessed chats, rotate exposed shared links if needed,
 53  and check for data export or artifact sharing by the same user.
 54"""
 55references = [
 56    "https://platform.claude.com/docs/en/api/compliance/activities/list",
 57]
 58risk_score = 47
 59rule_id = "a304c107-e0f0-4042-aa6c-5332ce6ca967"
 60severity = "medium"
 61tags = [
 62    "Domain: GenAI",
 63    "Platform: Anthropic",
 64    "Data Source: Anthropic Audit Logs",
 65    "Use Case: Threat Detection",
 66    "Use Case: UEBA",
 67    "Resources: Investigation Guide",
 68    "Rule Type: ES|QL",
 69    "Tactic: Discovery",
 70]
 71timestamp_override = "event.ingested"
 72type = "esql"
 73
 74query = '''
 75from logs-anthropic.audit-*
 76| where
 77    data_stream.dataset == "anthropic.audit" and
 78    event.action == "claude_chat_access_failed" and
 79    user.id is not null
 80| stats
 81    Esql.event_count = count(*),
 82    Esql.event_id_values = values(event.id),
 83    Esql.anthropic_audit_claude_chat_id_values = values(anthropic.audit.claude_chat_id),
 84    Esql.anthropic_audit_claude_project_id_values = values(anthropic.audit.claude_project_id),
 85    Esql.source_ip_values = values(source.ip),
 86    Esql.user_agent_original_values = values(user_agent.original),
 87    Esql.anthropic_audit_actor_type_values = values(anthropic.audit.actor.type),
 88    Esql.user_email_values = values(user.email),
 89    Esql.timestamp_first_seen = min(@timestamp),
 90    Esql.timestamp_last_seen = max(@timestamp)
 91  by user.id, organization.id, source.ip
 92| where Esql.event_count >= 20
 93| keep user.id, organization.id, source.ip, Esql.*
 94'''
 95
 96
 97[[rule.threat]]
 98framework = "MITRE ATT&CK"
 99[[rule.threat.technique]]
100id = "T1526"
101name = "Cloud Service Discovery"
102reference = "https://attack.mitre.org/techniques/T1526/"
103
104
105[rule.threat.tactic]
106id = "TA0007"
107name = "Discovery"
108reference = "https://attack.mitre.org/tactics/TA0007/"
109
110[rule.alert_suppression]
111group_by = ["user.id", "organization.id", "source.ip"]
112duration = {value = 24, unit = "h"}
113missing_fields_strategy = "suppress"
114
115[rule.investigation_fields]
116field_names = [
117    "user.id",
118    "organization.id",
119    "source.ip",
120    "Esql.event_count",
121    "Esql.event_id_values",
122    "Esql.user_email_values",
123    "Esql.anthropic_audit_claude_chat_id_values",
124    "Esql.anthropic_audit_claude_project_id_values",
125    "Esql.source_ip_values",
126    "Esql.user_agent_original_values",
127    "Esql.anthropic_audit_actor_type_values",
128    "Esql.timestamp_first_seen",
129    "Esql.timestamp_last_seen",
130]