Anthropic Organization User Invite Sent

  1[metadata]
  2creation_date = "2026/09/16"
  3integration = ["anthropic"]
  4maturity = "production"
  5updated_date = "2026/09/21"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Sending an organization user invite creates a path for a new member to join the Anthropic tenant with a chosen role.
 11An adversary who compromises an administrator or admin API key can invite a mailbox they control and accept the invite
 12to gain durable access. Invites may target internal corporate addresses or external domains; this rule does not
 13distinguish them because invite events do not carry verified organization domains for reliable comparison.
 14"""
 15false_positives = [
 16    """
 17    IT administrators and hiring workflows routinely invite new members during onboarding, contractor access, or
 18    staffing changes. Verify the invited email, role, and that a hiring or access request exists when policy requires
 19    one.
 20    """,
 21]
 22from = "now-9m"
 23language = "esql"
 24license = "Elastic License v2"
 25name = "Anthropic Organization User Invite Sent"
 26note = """## Triage and analysis
 27
 28### Investigating Anthropic Organization User Invite Sent
 29
 30A successful `org_user_invite_sent` creates a path for a new member. Invitee is `user.target.email` (also
 31`related.user`); role on accept is `anthropic.audit.invited_role` when present. Audit events do not include the org's
 32verified domain list — domain judgment is triage's job.
 33
 34Unauthorized / high priority: invitee domain outside known corporate domains, `invited_role` of admin (or similarly
 35privileged), actor is unexpected / API key, or invite followed by accept + privileged activity. Close as FP when HR/IT
 36ticket names the invitee and role.
 37
 38#### Possible investigation steps
 39
 40- Compare invitee domain to trusted corporate domains; treat unexpected external domains as higher priority.
 41- Branch actor: `user_actor` (email/IP/UA) vs `admin_api_key_actor`
 42  (`anthropic.audit.actor.admin_api_key_id` in inventory?).
 43- Search for `org_user_invite_accepted` for the same `anthropic.audit.invite_id` or invitee email.
 44- Look nearby for role grants, SSO changes, or admin API key creation from the same actor.
 45
 46### False positive analysis
 47
 48- Routine onboarding invites are FP when an HR/IT ticket names the invitee domain and `invited_role`.
 49
 50### Response and remediation
 51
 52- On unauthorized invite: delete/revoke the pending invite (and remove the user if already accepted), review other IAM
 53  changes by the same actor, and rotate compromised admin credentials or API keys.
 54"""
 55references = [
 56    "https://platform.claude.com/docs/en/api/compliance/activities/list",
 57]
 58risk_score = 47
 59rule_id = "5fd313e8-c61c-4737-88f7-b452a2f25a3b"
 60severity = "medium"
 61tags = [
 62    "Domain: GenAI",
 63    "Platform: Anthropic",
 64    "Data Source: Anthropic Audit Logs",
 65    "Use Case: Identity and Access Audit",
 66    "Use Case: Threat Detection",
 67    "Resources: Investigation Guide",
 68    "Rule Type: ES|QL",
 69    "Tactic: Persistence",
 70]
 71timestamp_override = "event.ingested"
 72type = "esql"
 73
 74query = '''
 75from logs-anthropic.audit-* metadata _id, _version, _index
 76| where
 77    data_stream.dataset == "anthropic.audit" and
 78    mv_contains(event.category, "iam") and
 79    event.action == "org_user_invite_sent" and
 80    event.outcome == "success"
 81| keep _id, _version, _index, @timestamp, event.*, organization.*, user.*, related.*, source.*, user_agent.*, anthropic.audit.*, data_stream.*
 82'''
 83
 84
 85[[rule.threat]]
 86framework = "MITRE ATT&CK"
 87[[rule.threat.technique]]
 88id = "T1136"
 89name = "Create Account"
 90reference = "https://attack.mitre.org/techniques/T1136/"
 91[[rule.threat.technique.subtechnique]]
 92id = "T1136.003"
 93name = "Cloud Account"
 94reference = "https://attack.mitre.org/techniques/T1136/003/"
 95
 96
 97
 98[rule.threat.tactic]
 99id = "TA0003"
100name = "Persistence"
101reference = "https://attack.mitre.org/tactics/TA0003/"
102
103[rule.investigation_fields]
104field_names = [
105    "@timestamp",
106    "event.action",
107    "event.id",
108    "event.outcome",
109    "organization.id",
110    "user.target.email",
111    "related.user",
112    "anthropic.audit.invited_role",
113    "anthropic.audit.invite_id",
114    "anthropic.audit.actor.type",
115    "anthropic.audit.actor.admin_api_key_id",
116    "user.email",
117    "user.id",
118    "source.ip",
119    "user_agent.original",
120]