Detection rules › Panther
Anthropic Organization Settings Updated
Detects when organization-wide settings are modified in Anthropic. These changes can affect security posture for all users (e.g., SSO configuration, data retention, access controls). The updates field identifies which settings were changed.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Stealth | T1562 Impair Defenses |
Rule body yaml
AnalysisType: rule
RuleID: Anthropic.Activity.Organization.Settings.Updated
DisplayName: "Anthropic Organization Settings Updated"
Enabled: true
Filename: anthropic_org_settings_updated.py
LogTypes:
- Anthropic.Activity
Severity: Medium
Description: >
Detects when organization-wide settings are modified in Anthropic. These changes
can affect security posture for all users (e.g., SSO configuration, data retention,
access controls). The updates field identifies which settings were changed.
Runbook: |
1. Find all Anthropic.Activity events by actor:email_address in the 6 hours before and after the alert to understand what other administrative actions they performed
2. Check if actor:email_address has performed claude_organization_settings_updated events in the past 90 days to determine if this is routine admin activity or a first-time action
3. Check if actor:ip_address is associated with known VPN/proxy services or matches previously seen IP addresses for this actor
Tags:
- Anthropic
- Configuration
Reports:
MITRE ATT&CK:
- TA0005:T1562 # Impair Defenses
Tests:
- Name: Org settings updated with updates field
ExpectedResult: true
Log:
{
"id": "activity_01ABC123",
"created_at": "2026-04-29T09:14:15Z",
"organization_id": "org_01XYZ",
"type": "claude_organization_settings_updated",
"updates": [{"type": "vcs_connections", "current_value": [{"org_name": "example-org", "type": "github"}]}],
"actor": {
"type": "user_actor",
"email_address": "admin@example.com",
"user_id": "user_01ABC",
"ip_address": "10.0.0.1",
"user_agent": "Mozilla/5.0"
}
}
- Name: Non-matching event type
ExpectedResult: false
Log:
{
"id": "activity_01DEF456",
"created_at": "2026-04-29T09:14:15Z",
"organization_id": "org_01XYZ",
"type": "claude_user_settings_updated",
"actor": {
"type": "user_actor",
"email_address": "user@example.com",
"user_id": "user_01DEF",
"ip_address": "10.0.0.2"
}
}
Detection logic
Condition
type eq "claude_organization_settings_updated"
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
type | eq |
|
Output fields
Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.
| Field | Source |
|---|---|
event_type | type |
actor_type | actor.type |
actor_email | actor.email_address |
actor_user_id | actor.user_id |
ip_address | actor.ip_address |
user_agent | actor.user_agent |
api_key_id | actor.api_key_id |
organization_id | |
ips | p_any_ip_addresses |