Anthropic Admin API Key Deleted

  1[metadata]
  2creation_date = "2026/09/12"
  3integration = ["anthropic"]
  4maturity = "production"
  5updated_date = "2026/09/21"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Admin API keys grant programmatic access to organization and compliance APIs. An attacker can delete legitimate admin
 11API keys to break security monitoring or integrations, or to cover tracks after creating replacement credentials they
 12control. Deletion without a nearby rotation event points more at sabotage than routine key hygiene.
 13"""
 14false_positives = [
 15    """
 16    Platform and security teams delete admin API keys during scheduled rotation or decommissioning. Check for a nearby
 17    `admin_api_key_created` event or an approved change ticket to explain the deletion.
 18    """,
 19]
 20from = "now-9m"
 21language = "esql"
 22license = "Elastic License v2"
 23name = "Anthropic Admin API Key Deleted"
 24note = """## Triage and analysis
 25
 26### Investigating Anthropic Admin API Key Deleted
 27
 28Deleting an admin API key can break Fleet/compliance ingestion or admin automation — or remove a defender-owned key
 29after an attacker creates a replacement they control.
 30
 31Unauthorized = deletion without a matching nearby `admin_api_key_created` (rotation) or decommission ticket, or
 32deletion by an unexpected actor paired with logging disablement / exports / SSO changes.
 33
 34#### Possible investigation steps
 35
 36- Note deleted `anthropic.audit.admin_api_key_id` and actor. For `user_actor`, validate admin identity (email/IP/UA).
 37  For `admin_api_key_actor`, check whether the deleting key (`actor.admin_api_key_id`) was itself recently created.
 38- Distinguish rotation (create+delete same window, same actor) from standalone deletion.
 39- Check whether Fleet/compliance ingestion stopped after the delete; correlate with compliance logging changes,
 40  exports, or SSO modifications.
 41
 42### False positive analysis
 43
 44- Scheduled rotation pairs delete with create during maintenance — ticket + sibling create event closes as FP.
 45
 46### Response and remediation
 47
 48- On unauthorized deletion: restore required integrations with new keys, verify audit ingestion, and review other
 49  admin changes by the same actor in the exposure window.
 50"""
 51references = [
 52    "https://platform.claude.com/docs/en/api/compliance/activities/list",
 53]
 54risk_score = 47
 55rule_id = "590b6961-e9d5-4ca9-ade0-978c1755a944"
 56severity = "medium"
 57tags = [
 58    "Domain: GenAI",
 59    "Platform: Anthropic",
 60    "Data Source: Anthropic Audit Logs",
 61    "Use Case: Identity and Access Audit",
 62    "Use Case: Threat Detection",
 63    "Resources: Investigation Guide",
 64    "Rule Type: ES|QL",
 65    "Tactic: Impact",
 66]
 67timestamp_override = "event.ingested"
 68type = "esql"
 69
 70query = '''
 71from logs-anthropic.audit-* metadata _id, _version, _index
 72| where
 73    data_stream.dataset == "anthropic.audit" and
 74    mv_contains(event.category, "iam") and
 75    event.action == "admin_api_key_deleted"
 76| keep _id, _version, _index, @timestamp, event.*, organization.*, user.*, source.*, user_agent.*, anthropic.audit.*, data_stream.*
 77'''
 78
 79
 80[[rule.threat]]
 81framework = "MITRE ATT&CK"
 82[[rule.threat.technique]]
 83id = "T1531"
 84name = "Account Access Removal"
 85reference = "https://attack.mitre.org/techniques/T1531/"
 86
 87
 88[rule.threat.tactic]
 89id = "TA0040"
 90name = "Impact"
 91reference = "https://attack.mitre.org/tactics/TA0040/"
 92
 93[rule.investigation_fields]
 94field_names = [
 95    "@timestamp",
 96    "event.action",
 97    "event.id",
 98    "organization.id",
 99    "user.email",
100    "user.id",
101    "anthropic.audit.admin_api_key_id",
102    "anthropic.audit.actor.admin_api_key_id",
103    "source.ip",
104    "user_agent.original",
105    "anthropic.audit.actor.type",
106]