Anthropic Compliance API Key Created

  1[metadata]
  2creation_date = "2026/09/12"
  3integration = ["anthropic"]
  4maturity = "production"
  5updated_date = "2026/09/21"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Compliance-scoped API keys read organization audit activity and compliance data. Once an attacker has administrative
 11access, creating one gives them programmatic read of chats, files, and membership without an interactive session. This
 12is separate from admin API key creation, which covers organization administration rather than compliance read scopes.
 13"""
 14false_positives = [
 15    """
 16    Platform and security teams create compliance-scoped API keys when onboarding the Anthropic Fleet integration or
 17    setting up SIEM ingestion. Verify the actor and confirm the key is in the approved credentials inventory.
 18    """,
 19]
 20from = "now-9m"
 21language = "esql"
 22license = "Elastic License v2"
 23name = "Anthropic Compliance API Key Created"
 24note = """## Triage and analysis
 25
 26### Investigating Anthropic Compliance API Key Created
 27
 28A new API key was created with compliance read scopes (audit/compliance data), distinct from admin API keys used for
 29org administration. Review `anthropic.audit.scopes` for exact permissions.
 30
 31Unauthorized = key not in approved inventory / no Fleet or investigation ticket, or creation by an unexpected actor
 32followed by `compliance_api_accessed` / audit export activity.
 33
 34#### Possible investigation steps
 35
 36- Record `anthropic.audit.api_key_id` and scopes. Branch actor (`user_actor` vs `admin_api_key_actor`) and validate
 37  against known platform admins or parent admin keys.
 38- Pivot on that `api_key_id` for later `compliance_api_accessed` (programmatic use of the new key).
 39- Correlate ±hours for admin role grants, logging disablement, or data exports — recon before further intrusion.
 40
 41### False positive analysis
 42
 43- First Fleet onboarding key for an org is expected — require inventory / ticket evidence.
 44
 45### Response and remediation
 46
 47- On unauthorized creation: revoke the key and review Compliance API / export activity during the exposure window.
 48"""
 49references = [
 50    "https://platform.claude.com/docs/en/api/compliance/activities/list",
 51]
 52risk_score = 73
 53rule_id = "b8c429a1-67f3-448c-a960-951807dd2cd8"
 54severity = "high"
 55tags = [
 56    "Domain: GenAI",
 57    "Platform: Anthropic",
 58    "Data Source: Anthropic Audit Logs",
 59    "Use Case: Identity and Access Audit",
 60    "Use Case: Threat Detection",
 61    "Resources: Investigation Guide",
 62    "Rule Type: ES|QL",
 63    "Tactic: Persistence",
 64]
 65timestamp_override = "event.ingested"
 66type = "esql"
 67
 68query = '''
 69from logs-anthropic.audit-* metadata _id, _version, _index
 70| where
 71    data_stream.dataset == "anthropic.audit" and
 72    event.action == "api_key_created" and
 73    event.outcome == "success" and
 74    anthropic.audit.scopes is not null and
 75    (
 76        mv_contains(anthropic.audit.scopes, "read:compliance_activities") or
 77        mv_contains(anthropic.audit.scopes, "read:compliance_org_data")
 78    )
 79| keep _id, _version, _index, @timestamp, event.*, organization.*, user.*, source.*, user_agent.*, anthropic.audit.*, data_stream.*
 80'''
 81
 82
 83[[rule.threat]]
 84framework = "MITRE ATT&CK"
 85[[rule.threat.technique]]
 86id = "T1098"
 87name = "Account Manipulation"
 88reference = "https://attack.mitre.org/techniques/T1098/"
 89[[rule.threat.technique.subtechnique]]
 90id = "T1098.001"
 91name = "Additional Cloud Credentials"
 92reference = "https://attack.mitre.org/techniques/T1098/001/"
 93
 94
 95
 96[rule.threat.tactic]
 97id = "TA0003"
 98name = "Persistence"
 99reference = "https://attack.mitre.org/tactics/TA0003/"
100
101[rule.investigation_fields]
102field_names = [
103    "@timestamp",
104    "event.action",
105    "event.id",
106    "organization.id",
107    "anthropic.audit.api_key_id",
108    "anthropic.audit.scopes",
109    "anthropic.audit.actor.type",
110    "anthropic.audit.actor.admin_api_key_id",
111    "user.email",
112    "user.id",
113    "source.ip",
114    "user_agent.original",
115]