Anthropic Compliance API Logging Disabled

Last updated 4 days ago on 2026-09-21

Created 13 days ago on 2026-09-12

About

Compliance API logging feeds the anthropic.audit dataset that Anthropic audit detections run on. An attacker with administrative access can disable it so later role grants, API key creation, exports, and authentication changes stop reaching this data source. This rule detects the disable action itself. Activity that happens after logging stops may not appear in logs-anthropic.audit-*.

Tags

Domain: GenAIPlatform: AnthropicData Source: Anthropic Audit LogsUse Case: Log AuditingUse Case: Threat DetectionRule Type: ES|QLTactic: Defense EvasionLanguage: esql

Severity

high

Risk Score

MITRE ATT&CK™

Defense Evasion (TA0005)(external, opens in a new tab or window)

↳ Impair Defenses (T1562)(external, opens in a new tab or window)

False Positive Examples

Platform or security administrators disable compliance logging during onboarding, integration testing, or log pipeline migrations. Verify the actor, source IP, and whether logging was re-enabled promptly. Planned changes can be exempted from this rule.

License

Elastic License v2(external, opens in a new tab or window)

Definition

Integration Pack: Prebuilt Security Detection Rules
Related Integrations: anthropic(external, opens in a new tab or window)
Query

✄𐘗text code block:
✄𐘗from logs-anthropic.audit-* metadata _id, _version, _index
| where
    data_stream.dataset == "anthropic.audit" and
    mv_contains(event.category, "configuration") and
    event.action == "org_compliance_api_settings_updated" and
    anthropic.audit.compliance_api_logging_enabled == false
| keep _id, _version, _index, @timestamp, event.*, organization.*, user.*, source.*, user_agent.*, anthropic.audit.*, data_stream.*

Install detection rules in Elastic Security

Detect Anthropic Compliance API Logging Disabled in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(external, opens in a new tab or window).