Anthropic Organization User Invite Sent

  1[metadata]
  2creation_date = "2026/09/16"
  3integration = ["anthropic"]
  4maturity = "production"
  5updated_date = "2026/09/25"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Sending an organization user invite creates a path for a new member to join the Anthropic tenant with a chosen role. An
 11adversary who compromises an administrator or admin API key can invite a mailbox they control and accept the invite to
 12gain durable access. Invites may target internal corporate addresses or external domains; this rule does not distinguish
 13them because invite events do not carry verified organization domains for reliable comparison.
 14"""
 15false_positives = [
 16    """
 17    IT administrators and hiring workflows routinely invite new members during onboarding, contractor access, or
 18    staffing changes. Verify the invited email, role, and that a hiring or access request exists when policy requires
 19    one.
 20    """,
 21]
 22from = "now-9m"
 23language = "esql"
 24license = "Elastic License v2"
 25name = "Anthropic Organization User Invite Sent"
 26note = """## Triage and analysis
 27
 28### Investigating Anthropic Organization User Invite Sent
 29
 30A successful `org_user_invite_sent` creates a path for a new member. Invitee is `user.target.email` (also
 31`related.user`); role on accept is `anthropic.audit.invited_role` when present. Audit events do not include the org's
 32verified domain list — domain judgment is triage's job.
 33
 34Unauthorized / high priority: invitee domain outside known corporate domains, `invited_role` of admin (or similarly
 35privileged), actor is unexpected / API key, or invite followed by accept + privileged activity. Close as FP when HR/IT
 36ticket names the invitee and role.
 37
 38#### Possible investigation steps
 39
 40- Compare invitee domain to trusted corporate domains; treat unexpected external domains as higher priority.
 41- Branch actor: `user_actor` (email/IP/UA) vs `admin_api_key_actor`
 42  (`anthropic.audit.actor.admin_api_key_id` in inventory?).
 43- Search for `org_user_invite_accepted` for the same `anthropic.audit.invite_id` or invitee email.
 44- Look nearby for role grants, SSO changes, or admin API key creation from the same actor.
 45
 46### False positive analysis
 47
 48- Routine onboarding invites are FP when an HR/IT ticket names the invitee domain and `invited_role`.
 49
 50### Response and remediation
 51
 52- On unauthorized invite: delete/revoke the pending invite (and remove the user if already accepted), review other IAM
 53  changes by the same actor, and rotate compromised admin credentials or API keys.
 54"""
 55references = ["https://platform.claude.com/docs/en/api/compliance/activities/list"]
 56risk_score = 47
 57rule_id = "5fd313e8-c61c-4737-88f7-b452a2f25a3b"
 58severity = "medium"
 59tags = [
 60    "Domain: GenAI",
 61    "Platform: Anthropic",
 62    "Data Source: Anthropic Audit Logs",
 63    "Use Case: Identity and Access Audit",
 64    "Use Case: Threat Detection",
 65    "Resources: Investigation Guide",
 66    "Rule Type: ES|QL",
 67    "Tactic: Persistence",
 68    "Mitre Atlas: AML.T0125",
 69]
 70timestamp_override = "event.ingested"
 71type = "esql"
 72
 73query = '''
 74from logs-anthropic.audit-* metadata _id, _version, _index
 75| where
 76    data_stream.dataset == "anthropic.audit" and
 77    mv_contains(event.category, "iam") and
 78    event.action == "org_user_invite_sent" and
 79    event.outcome == "success"
 80| keep _id, _version, _index, @timestamp, event.*, organization.*, user.*, related.*, source.*, user_agent.*, anthropic.audit.*, data_stream.*
 81'''
 82
 83
 84[[rule.threat]]
 85framework = "MITRE ATT&CK"
 86[[rule.threat.technique]]
 87id = "T1136"
 88name = "Create Account"
 89reference = "https://attack.mitre.org/techniques/T1136/"
 90[[rule.threat.technique.subtechnique]]
 91id = "T1136.003"
 92name = "Cloud Account"
 93reference = "https://attack.mitre.org/techniques/T1136/003/"
 94
 95
 96
 97[rule.threat.tactic]
 98id = "TA0003"
 99name = "Persistence"
100reference = "https://attack.mitre.org/tactics/TA0003/"
101[[rule.threat_mappings]]
102framework = "MITRE ATLAS"
103version = "2026.08"
104[[rule.threat_mappings.threat]]
105framework = "MITRE ATLAS"
106[[rule.threat_mappings.threat.technique]]
107id = "AML.T0125"
108name = "Create Account"
109reference = "https://atlas.mitre.org/techniques/AML.T0125/"
110
111
112[rule.threat_mappings.threat.tactic]
113id = "AML.TA0006"
114name = "Persistence"
115reference = "https://atlas.mitre.org/tactics/AML.TA0006/"
116
117[rule.investigation_fields]
118field_names = [
119    "@timestamp",
120    "event.action",
121    "event.id",
122    "event.outcome",
123    "organization.id",
124    "user.target.email",
125    "related.user",
126    "anthropic.audit.invited_role",
127    "anthropic.audit.invite_id",
128    "anthropic.audit.actor.type",
129    "anthropic.audit.actor.admin_api_key_id",
130    "user.email",
131    "user.id",
132    "source.ip",
133    "user_agent.original",
134]