Anthropic Excessive Chat Snapshot Creation

  1[metadata]
  2creation_date = "2026/09/16"
  3integration = ["anthropic"]
  4maturity = "production"
  5updated_date = "2026/09/25"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects an unusually high number of successful Claude chat snapshot creation events for the same user email within a
 11rolling 24-hour window. Chat snapshots package conversation content into shareable exports; sustained creation volume
 12can indicate staging of organizational chat data for exfiltration via Anthropic's web service or automated bulk export
 13of sensitive prompts and responses.
 14"""
 15false_positives = [
 16    """
 17    Power users, trainers, or documentation owners who intentionally snapshot many chats for sharing, archival, or
 18    handoff workflows can exceed the threshold without malicious intent.
 19    """,
 20]
 21from = "now-24h"
 22interval = "1h"
 23language = "esql"
 24license = "Elastic License v2"
 25name = "Anthropic Excessive Chat Snapshot Creation"
 26note = """## Triage and analysis
 27
 28### Investigating Anthropic Excessive Chat Snapshot Creation
 29
 30One mailbox created many chat snapshots in 24 hours. Snapshots can package conversation content for handoff — or for
 31exfiltration staging. Source IP/UA are investigation fields, not grouping keys, so multi-IP bursts still accumulate.
 32
 33Escalate when scripting UA, concurrent file uploads / public artifact sharing / data exports / chat deletions appear,
 34or snapshots span many unrelated chats. Close as FP for documented knowledge handoffs, training packaging, or
 35compliance archival automation.
 36
 37#### Possible investigation steps
 38
 39- Review event count and snapshot/chat ID lists — many distinct chats is stronger than repeated snapshots of one chat.
 40- Inspect IP/UA values for automation. Correlate with uploads, public artifact sharing, exports, or deletions from
 41  the same email.
 42- Note actor type and whether the same email appears across organizations (`organization_id` values).
 43
 44### False positive analysis
 45
 46- Power-user archival and compliance snapshot jobs commonly exceed the threshold.
 47
 48### Response and remediation
 49
 50- On unauthorized staging: revoke sessions, review snapshot destinations and shared links, and tighten chat sharing
 51  or export policy for the actor.
 52"""
 53references = ["https://platform.claude.com/docs/en/api/compliance/activities/list"]
 54risk_score = 47
 55rule_id = "0cd6c462-28eb-482a-b445-9ced6a034b49"
 56severity = "medium"
 57tags = [
 58    "Domain: GenAI",
 59    "Platform: Anthropic",
 60    "Data Source: Anthropic Audit Logs",
 61    "Use Case: Threat Detection",
 62    "Use Case: UEBA",
 63    "Resources: Investigation Guide",
 64    "Rule Type: ES|QL",
 65    "Tactic: Exfiltration",
 66    "Mitre Atlas: AML.T0085",
 67    "Mitre Atlas: AML.T0025",
 68]
 69timestamp_override = "event.ingested"
 70type = "esql"
 71
 72query = '''
 73from logs-anthropic.audit-*
 74| where
 75    data_stream.dataset == "anthropic.audit" and
 76    mv_contains(event.category, "file") and
 77    event.action == "claude_chat_snapshot_created" and
 78    event.outcome == "success" and
 79    user.email is not null
 80| stats
 81    Esql.event_count = count(*),
 82    Esql.event_id_values = values(event.id),
 83    Esql.anthropic_audit_claude_chat_snapshot_id_values = values(anthropic.audit.claude_chat_snapshot_id),
 84    Esql.anthropic_audit_claude_chat_id_values = values(anthropic.audit.claude_chat_id),
 85    Esql.source_ip_values = values(source.ip),
 86    Esql.user_agent_original_values = values(user_agent.original),
 87    Esql.anthropic_audit_actor_type_values = values(anthropic.audit.actor.type),
 88    Esql.organization_id_values = values(organization.id),
 89    Esql.user_id_values = values(user.id),
 90    Esql.timestamp_first_seen = min(@timestamp),
 91    Esql.timestamp_last_seen = max(@timestamp)
 92  by user.email
 93| where Esql.event_count >= 10
 94| keep user.email, Esql.*
 95'''
 96
 97
 98[[rule.threat]]
 99framework = "MITRE ATT&CK"
100[[rule.threat.technique]]
101id = "T1567"
102name = "Exfiltration Over Web Service"
103reference = "https://attack.mitre.org/techniques/T1567/"
104
105
106[rule.threat.tactic]
107id = "TA0010"
108name = "Exfiltration"
109reference = "https://attack.mitre.org/tactics/TA0010/"
110[[rule.threat_mappings]]
111framework = "MITRE ATLAS"
112version = "2026.08"
113[[rule.threat_mappings.threat]]
114framework = "MITRE ATLAS"
115[[rule.threat_mappings.threat.technique]]
116id = "AML.T0085"
117name = "Data from AI Services"
118reference = "https://atlas.mitre.org/techniques/AML.T0085/"
119
120
121[rule.threat_mappings.threat.tactic]
122id = "AML.TA0009"
123name = "Collection"
124reference = "https://atlas.mitre.org/tactics/AML.TA0009/"
125[[rule.threat_mappings.threat]]
126framework = "MITRE ATLAS"
127[[rule.threat_mappings.threat.technique]]
128id = "AML.T0025"
129name = "Exfiltration via Cyber Means"
130reference = "https://atlas.mitre.org/techniques/AML.T0025/"
131
132
133[rule.threat_mappings.threat.tactic]
134id = "AML.TA0010"
135name = "Exfiltration"
136reference = "https://atlas.mitre.org/tactics/AML.TA0010/"
137
138[rule.alert_suppression]
139group_by = ["user.email"]
140missing_fields_strategy = "suppress"
141
142[rule.investigation_fields]
143field_names = [
144    "user.email",
145    "Esql.event_count",
146    "Esql.event_id_values",
147    "Esql.anthropic_audit_claude_chat_snapshot_id_values",
148    "Esql.anthropic_audit_claude_chat_id_values",
149    "Esql.source_ip_values",
150    "Esql.user_agent_original_values",
151    "Esql.anthropic_audit_actor_type_values",
152    "Esql.organization_id_values",
153    "Esql.user_id_values",
154    "Esql.timestamp_first_seen",
155    "Esql.timestamp_last_seen",
156]
157
158[rule.alert_suppression.duration]
159unit = "h"
160value = 24