Detection rules › Panther
Anthropic Artifact Shared Publicly
Detects when an artifact's sharing audience is changed to public. Public artifacts are accessible to anyone with the link, which could expose sensitive content outside the organization.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Exfiltration | T1567 Exfiltration Over Web Service |
Rule body yaml
AnalysisType: rule
RuleID: Anthropic.Activity.Artifact.Shared.Publicly
DisplayName: "Anthropic Artifact Shared Publicly"
Enabled: true
Filename: anthropic_artifact_shared_publicly.py
LogTypes:
- Anthropic.Activity
Severity: Medium
Description: >
Detects when an artifact's sharing audience is changed to public. Public
artifacts are accessible to anyone with the link, which could expose
sensitive content outside the organization.
Runbook: |
1. Find all Anthropic.Activity events by actor:email_address in the 1 hour before and after the alert to understand the context of the sharing change
2. Check if the claude_artifact_id has been viewed or accessed by external users in the 24 hours after the sharing change
3. Check if actor:email_address has shared other artifacts publicly in the past 30 days to determine if this is a pattern
Tags:
- Anthropic
- Data Loss Prevention
Reports:
MITRE ATT&CK:
- TA0010:T1567 # Exfiltration Over Web Service
Tests:
- Name: Artifact shared publicly
ExpectedResult: true
Log:
{
"id": "activity_01ABC123",
"created_at": "2026-05-07T09:10:01Z",
"organization_id": "org_01XYZ",
"type": "claude_artifact_sharing_updated",
"claude_artifact_id": "claude_artifact_01ABC",
"audience": [{"type": "public"}],
"actor": {
"type": "user_actor",
"email_address": "user@example.com",
"user_id": "user_01ABC",
"ip_address": "10.0.0.1",
"user_agent": "Mozilla/5.0"
}
}
- Name: Artifact shared with organization only
ExpectedResult: false
Log:
{
"id": "activity_01DEF456",
"created_at": "2026-05-07T09:10:01Z",
"organization_id": "org_01XYZ",
"type": "claude_artifact_sharing_updated",
"claude_artifact_id": "claude_artifact_01DEF",
"audience": [{"type": "organization"}],
"actor": {
"type": "user_actor",
"email_address": "user@example.com",
"user_id": "user_01DEF",
"ip_address": "10.0.0.2"
}
}
- Name: Non-matching event type
ExpectedResult: false
Log:
{
"id": "activity_01GHI789",
"created_at": "2026-05-07T09:10:01Z",
"organization_id": "org_01XYZ",
"type": "claude_chat_created",
"actor": {
"type": "user_actor",
"email_address": "user@example.com",
"user_id": "user_01GHI",
"ip_address": "10.0.0.3"
}
}
Detection logic
Condition
type eq "claude_artifact_sharing_updated"
audience is_not_null
audience contains "'public'" or audience contains "\"public\""
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
Output fields
Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.
| Field | Source |
|---|---|
event_type | type |
actor_type | actor.type |
actor_email | actor.email_address |
actor_user_id | actor.user_id |
ip_address | actor.ip_address |
user_agent | actor.user_agent |
api_key_id | actor.api_key_id |
organization_id | |
ips | p_any_ip_addresses |
claude_artifact_id |