Elastic Security Detection Rules

Anthropic Compliance Audit Log Export Accessed

Last updated 5 days ago on 2026-09-21
Created 14 days ago on 2026-09-12

About

An audit log export archive was accessed, meaning the actor downloaded exported audit activity. Attackers pull audit exports to see what defenders can observe, look for detection gaps, or remove evidence before making other control-plane changes.
Tags
Domain: GenAIPlatform: AnthropicData Source: Anthropic Audit LogsUse Case: Threat DetectionRule Type: ES|QLTactic: CollectionLanguage: esql
Severity
medium
Risk Score
47
MITRE ATT&CK™

Collection (TA0009)(external, opens in a new tab or window)

↳ Data from Cloud Storage (T1530)(external, opens in a new tab or window)

False Positive Examples
Security and compliance teams download audit log exports for investigations, regulatory requests, or SIEM validation. Validate the actor and confirm the activity matches an approved ticket.
License
Elastic License v2(external, opens in a new tab or window)

Definition

Integration Pack
Prebuilt Security Detection Rules
Related Integrations

anthropic(external, opens in a new tab or window)

Query
text code block:
from logs-anthropic.audit-* metadata _id, _version, _index
| where
    data_stream.dataset == "anthropic.audit" and
    mv_contains(event.category, "file") and
    event.action == "audit_log_export_accessed"
| keep _id, _version, _index, @timestamp, event.*, organization.*, user.*, source.*, user_agent.*, anthropic.audit.*, data_stream.*

Install detection rules in Elastic Security

Detect Anthropic Compliance Audit Log Export Accessed in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(external, opens in a new tab or window).