Anthropic Excessive Chat Snapshot Creation

  1[metadata]
  2creation_date = "2026/09/16"
  3integration = ["anthropic"]
  4maturity = "production"
  5updated_date = "2026/09/21"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects an unusually high number of successful Claude chat snapshot creation events for the same user email within a
 11rolling 24-hour window. Chat snapshots package conversation content into shareable exports; sustained creation volume
 12can indicate staging of organizational chat data for exfiltration via Anthropic's web service or automated bulk export
 13of sensitive prompts and responses.
 14"""
 15false_positives = [
 16    """
 17    Power users, trainers, or documentation owners who intentionally snapshot many chats for sharing, archival, or
 18    handoff workflows can exceed the threshold without malicious intent.
 19    """,
 20]
 21from = "now-24h"
 22interval = "1h"
 23language = "esql"
 24license = "Elastic License v2"
 25name = "Anthropic Excessive Chat Snapshot Creation"
 26note = """## Triage and analysis
 27
 28### Investigating Anthropic Excessive Chat Snapshot Creation
 29
 30One mailbox created many chat snapshots in 24 hours. Snapshots can package conversation content for handoff — or for
 31exfiltration staging. Source IP/UA are investigation fields, not grouping keys, so multi-IP bursts still accumulate.
 32
 33Escalate when scripting UA, concurrent file uploads / public artifact sharing / data exports / chat deletions appear,
 34or snapshots span many unrelated chats. Close as FP for documented knowledge handoffs, training packaging, or
 35compliance archival automation.
 36
 37#### Possible investigation steps
 38
 39- Review event count and snapshot/chat ID lists — many distinct chats is stronger than repeated snapshots of one chat.
 40- Inspect IP/UA values for automation. Correlate with uploads, public artifact sharing, exports, or deletions from
 41  the same email.
 42- Note actor type and whether the same email appears across organizations (`organization_id` values).
 43
 44### False positive analysis
 45
 46- Power-user archival and compliance snapshot jobs commonly exceed the threshold.
 47
 48### Response and remediation
 49
 50- On unauthorized staging: revoke sessions, review snapshot destinations and shared links, and tighten chat sharing
 51  or export policy for the actor.
 52"""
 53references = [
 54    "https://platform.claude.com/docs/en/api/compliance/activities/list",
 55]
 56risk_score = 47
 57rule_id = "0cd6c462-28eb-482a-b445-9ced6a034b49"
 58severity = "medium"
 59tags = [
 60    "Domain: GenAI",
 61    "Platform: Anthropic",
 62    "Data Source: Anthropic Audit Logs",
 63    "Use Case: Threat Detection",
 64    "Use Case: UEBA",
 65    "Resources: Investigation Guide",
 66    "Rule Type: ES|QL",
 67    "Tactic: Exfiltration",
 68]
 69timestamp_override = "event.ingested"
 70type = "esql"
 71
 72query = '''
 73from logs-anthropic.audit-*
 74| where
 75    data_stream.dataset == "anthropic.audit" and
 76    mv_contains(event.category, "file") and
 77    event.action == "claude_chat_snapshot_created" and
 78    event.outcome == "success" and
 79    user.email is not null
 80| stats
 81    Esql.event_count = count(*),
 82    Esql.event_id_values = values(event.id),
 83    Esql.anthropic_audit_claude_chat_snapshot_id_values = values(anthropic.audit.claude_chat_snapshot_id),
 84    Esql.anthropic_audit_claude_chat_id_values = values(anthropic.audit.claude_chat_id),
 85    Esql.source_ip_values = values(source.ip),
 86    Esql.user_agent_original_values = values(user_agent.original),
 87    Esql.anthropic_audit_actor_type_values = values(anthropic.audit.actor.type),
 88    Esql.organization_id_values = values(organization.id),
 89    Esql.user_id_values = values(user.id),
 90    Esql.timestamp_first_seen = min(@timestamp),
 91    Esql.timestamp_last_seen = max(@timestamp)
 92  by user.email
 93| where Esql.event_count >= 10
 94| keep user.email, Esql.*
 95'''
 96
 97
 98[[rule.threat]]
 99framework = "MITRE ATT&CK"
100[[rule.threat.technique]]
101id = "T1567"
102name = "Exfiltration Over Web Service"
103reference = "https://attack.mitre.org/techniques/T1567/"
104
105
106[rule.threat.tactic]
107id = "TA0010"
108name = "Exfiltration"
109reference = "https://attack.mitre.org/tactics/TA0010/"
110
111[rule.alert_suppression]
112group_by = ["user.email"]
113duration = {value = 24, unit = "h"}
114missing_fields_strategy = "suppress"
115
116[rule.investigation_fields]
117field_names = [
118    "user.email",
119    "Esql.event_count",
120    "Esql.event_id_values",
121    "Esql.anthropic_audit_claude_chat_snapshot_id_values",
122    "Esql.anthropic_audit_claude_chat_id_values",
123    "Esql.source_ip_values",
124    "Esql.user_agent_original_values",
125    "Esql.anthropic_audit_actor_type_values",
126    "Esql.organization_id_values",
127    "Esql.user_id_values",
128    "Esql.timestamp_first_seen",
129    "Esql.timestamp_last_seen",
130]