Anthropic MCP Server Created

  1[metadata]
  2creation_date = "2026/09/12"
  3integration = ["anthropic"]
  4maturity = "production"
  5updated_date = "2026/09/21"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects the first successful creation of a Model Context Protocol (MCP) server integration name in an Anthropic
 11organization within the rule history window. MCP servers add external data pathways into Claude and can expose
 12organizational data to third-party infrastructure. This is a New Terms rule keyed on `organization.id` and
 13`anthropic.audit.mcp_server_name` so the same connector name can still alert in another tenant, while routine
 14re-creation of an already-seen name in the same organization does not.
 15"""
 16false_positives = [
 17    """
 18    Teams enable approved MCP connectors for data platforms, ticketing systems, and internal tools during Claude
 19    rollouts. Validate the server name, actor, and whether the integration matches an approved request.
 20    """,
 21]
 22from = "now-9m"
 23index = ["logs-anthropic.audit-*"]
 24language = "kuery"
 25license = "Elastic License v2"
 26name = "Anthropic MCP Server Created"
 27note = """## Triage and analysis
 28
 29### Investigating Anthropic MCP Server Created
 30
 31First-seen MCP server name for this `organization.id` within the rule history window. MCP connectors add external
 32data pathways into Claude.
 33
 34Unauthorized = server name not on approved integration inventory, actor is unexpected/contractor without a request,
 35or creation pairs with data export / public artifact sharing / privilege changes. Close as FP when inventory and
 36pilot/onboarding ticket match.
 37
 38#### Possible investigation steps
 39
 40- Record `anthropic.audit.mcp_server_name` / `mcp_server_id` and actor. For `user_actor`, validate email/IP/UA
 41  against platform admins.
 42- Search `mcp_server_updated` / `mcp_server_deleted` for the same server ID; look for exports, artifact sharing, or
 43  admin role grants in the same window.
 44- Close as FP when inventory + pilot ticket match the name; escalate unknown connector names immediately.
 45
 46### False positive analysis
 47
 48- Claude pilots commonly introduce first-seen approved connector names from platform teams.
 49
 50### Response and remediation
 51
 52- On unauthorized creation: remove the MCP server and review data accessed through the connector during the exposure
 53  window.
 54"""
 55references = [
 56    "https://platform.claude.com/docs/en/api/compliance/activities/list",
 57]
 58risk_score = 47
 59rule_id = "e3acc6d4-cd6e-4748-baeb-1c57a0f37635"
 60severity = "medium"
 61tags = [
 62    "Domain: GenAI",
 63    "Platform: Anthropic",
 64    "Data Source: Anthropic Audit Logs",
 65    "Use Case: Threat Detection",
 66    "Use Case: UEBA",
 67    "Resources: Investigation Guide",
 68    "Rule Type: New Terms",
 69    "Tactic: Persistence",
 70]
 71timestamp_override = "event.ingested"
 72type = "new_terms"
 73
 74query = '''
 75data_stream.dataset: "anthropic.audit" and
 76    event.category: "configuration" and
 77    event.action: "mcp_server_created" and
 78    event.outcome: "success"
 79'''
 80
 81
 82[[rule.threat]]
 83framework = "MITRE ATT&CK"
 84[[rule.threat.technique]]
 85id = "T1176"
 86name = "Software Extensions"
 87reference = "https://attack.mitre.org/techniques/T1176/"
 88
 89
 90
 91[rule.threat.tactic]
 92id = "TA0003"
 93name = "Persistence"
 94reference = "https://attack.mitre.org/tactics/TA0003/"
 95
 96[rule.investigation_fields]
 97field_names = [
 98    "@timestamp",
 99    "event.action",
100    "event.id",
101    "organization.id",
102    "anthropic.audit.mcp_server_id",
103    "anthropic.audit.mcp_server_name",
104    "anthropic.audit.actor.type",
105    "user.email",
106    "user.id",
107    "source.ip",
108    "user_agent.original",
109]
110
111[rule.new_terms]
112field = "new_terms_fields"
113value = ["organization.id", "anthropic.audit.mcp_server_name"]
114[[rule.new_terms.history_window_start]]
115field = "history_window_start"
116value = "now-14d"