Anthropic IP Restriction Deleted

AnalysisType: rule
RuleID: Anthropic.Activity.IP.Restriction.Deleted
DisplayName: "Anthropic IP Restriction Deleted"
Enabled: true
Filename: anthropic_ip_restriction_deleted.py
LogTypes:
  - Anthropic.Activity
Severity: High
Description: >
  Detects when an organization IP restriction is deleted. IP restrictions
  are a critical network-level access control — removing them allows access
  from any IP address, which could indicate an attacker widening the attack
  surface after gaining admin access.
Runbook: |
  1. Find all Anthropic.Activity events by actor:email_address in the 24 hours before the alert to identify any suspicious activity leading up to the IP restriction change
  2. Check if actor:ip_address matches previously seen IP addresses for this actor in the past 30 days to detect potential account compromise
  3. Check if other org_ip_restriction events (created, updated) occurred in the 1 hour around the alert to determine if this is a policy replacement or a standalone deletion
Tags:
  - Anthropic
  - Network Security
  - Defense Evasion
Reports:
  MITRE ATT&CK:
    - TA0005:T1562.001  # Impair Defenses: Disable or Modify Tools
Tests:
  - Name: IP restriction deleted
    ExpectedResult: true
    Log:
      {
        "id": "activity_01ABC123",
        "created_at": "2026-05-07T10:00:00Z",
        "organization_id": "org_01XYZ",
        "type": "org_ip_restriction_deleted",
        "actor": {
          "type": "user_actor",
          "email_address": "admin@example.com",
          "user_id": "user_01ABC",
          "ip_address": "10.0.0.1",
          "user_agent": "Mozilla/5.0"
        }
      }
  - Name: IP restriction created - not a match
    ExpectedResult: false
    Log:
      {
        "id": "activity_01DEF456",
        "created_at": "2026-05-07T10:00:00Z",
        "organization_id": "org_01XYZ",
        "type": "org_ip_restriction_created",
        "actor": {
          "type": "user_actor",
          "email_address": "admin@example.com",
          "user_id": "user_01ABC",
          "ip_address": "10.0.0.1"
        }
      }