Anthropic Admin API Key Created

  1[metadata]
  2creation_date = "2026/09/12"
  3integration = ["anthropic"]
  4maturity = "production"
  5updated_date = "2026/09/21"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Admin API keys grant programmatic access to organization and compliance APIs outside an interactive browser session.
 11An attacker who creates one after compromise can automate role grants, exports, and logging changes without holding a
 12user session that would time out under SSO. The key also survives password resets and IdP lockout if defenders revoke
 13the interactive account but miss the API credential.
 14"""
 15false_positives = [
 16    """
 17    Platform, security, and observability teams create admin API keys during integration setup or scheduled key
 18    rotation. Verify the actor, `anthropic.audit.scopes`, and whether the creation matches an approved change.
 19    """,
 20]
 21from = "now-9m"
 22language = "esql"
 23license = "Elastic License v2"
 24name = "Anthropic Admin API Key Created"
 25note = """## Triage and analysis
 26
 27### Investigating Anthropic Admin API Key Created
 28
 29Admin API keys provide durable programmatic org/compliance access that survives interactive session revocation.
 30Scopes at creation determine blast radius.
 31
 32Unauthorized = key not in the approved credentials inventory, no integration/onboarding ticket, or creation by an
 33actor who just received admin / ownership and immediately mints a key — especially before exports or SSO changes.
 34
 35#### Possible investigation steps
 36
 37- Record `anthropic.audit.admin_api_key_id` and `anthropic.audit.scopes` for later revoke and correlation.
 38- Branch actor: `user_actor` → is `user.email` / `source.ip` / UA a known platform admin? Scripting UA is higher
 39  priority than a normal browser admin console session.
 40- Check whether the actor recently gained admin or primary ownership; look ±hours for exports, SSO changes, or
 41  compliance logging changes from the same org.
 42- Close as FP when inventory + ticket match. Escalate when the key is unknown or precedes control-plane abuse.
 43
 44### False positive analysis
 45
 46- Fleet / SIEM onboarding and scheduled rotation routinely create admin keys — require inventory evidence.
 47
 48### Response and remediation
 49
 50- On unauthorized creation: revoke the key in Anthropic admin, rotate other admin credentials, and review API activity
 51  attributable to that `anthropic.audit.admin_api_key_id` during the exposure window.
 52"""
 53references = [
 54    "https://platform.claude.com/docs/en/api/compliance/activities/list",
 55]
 56risk_score = 47
 57rule_id = "4051e709-03b6-4782-aae3-e58dde33642b"
 58severity = "medium"
 59tags = [
 60    "Domain: GenAI",
 61    "Platform: Anthropic",
 62    "Data Source: Anthropic Audit Logs",
 63    "Use Case: Identity and Access Audit",
 64    "Use Case: Threat Detection",
 65    "Resources: Investigation Guide",
 66    "Rule Type: ES|QL",
 67    "Tactic: Persistence",
 68]
 69timestamp_override = "event.ingested"
 70type = "esql"
 71
 72query = '''
 73from logs-anthropic.audit-* metadata _id, _version, _index
 74| where
 75    data_stream.dataset == "anthropic.audit" and
 76    mv_contains(event.category, "iam") and
 77    event.action == "admin_api_key_created"
 78| keep _id, _version, _index, @timestamp, event.*, organization.*, user.*, source.*, user_agent.*, anthropic.audit.*, data_stream.*
 79'''
 80
 81
 82[[rule.threat]]
 83framework = "MITRE ATT&CK"
 84[[rule.threat.technique]]
 85id = "T1098"
 86name = "Account Manipulation"
 87reference = "https://attack.mitre.org/techniques/T1098/"
 88[[rule.threat.technique.subtechnique]]
 89id = "T1098.001"
 90name = "Additional Cloud Credentials"
 91reference = "https://attack.mitre.org/techniques/T1098/001/"
 92
 93
 94
 95[rule.threat.tactic]
 96id = "TA0003"
 97name = "Persistence"
 98reference = "https://attack.mitre.org/tactics/TA0003/"
 99
100[rule.investigation_fields]
101field_names = [
102    "@timestamp",
103    "event.action",
104    "event.id",
105    "organization.id",
106    "user.email",
107    "user.id",
108    "anthropic.audit.admin_api_key_id",
109    "anthropic.audit.scopes",
110    "source.ip",
111    "user_agent.original",
112    "anthropic.audit.actor.type",
113]