Anthropic Organization User Deleted

AnalysisType: rule
RuleID: Anthropic.Activity.Org.User.Deleted
DisplayName: "Anthropic Organization User Deleted"
Enabled: true
Filename: anthropic_org_user_deleted.py
LogTypes:
  - Anthropic.Activity
Severity: Info
Description: >
  Tracks when a user is removed from the Anthropic organization. Logged
  for compliance visibility into user lifecycle changes. The deleted_user_id
  and deleted_user_email fields identify who was removed.
Runbook: |
  1. Find all Anthropic.Activity events by actor:email_address in the 6 hours before and after the alert to determine if this is part of routine offboarding or an isolated deletion
  2. Check if the deleted user had any unusual activity (claude_chat_access_failed, claude_organization_settings_updated) in the 7 days before removal
  3. Check if actor:email_address has deleted other users in the past 7 days to identify potential bulk unauthorized removals
Tags:
  - Anthropic
  - Compliance
  - User Lifecycle
Reports:
  MITRE ATT&CK:
    - TA0040:T1531  # Account Access Removal
Tests:
  - Name: Org user deleted
    ExpectedResult: true
    Log:
      {
        "id": "activity_01ABC123",
        "created_at": "2026-05-07T10:00:00Z",
        "organization_id": "org_01XYZ",
        "type": "org_user_deleted",
        "deleted_user_id": "user_01DEF",
        "deleted_user_email": "deleted-user@example.com",
        "actor": {
          "type": "user_actor",
          "email_address": "admin@example.com",
          "user_id": "user_01ABC",
          "ip_address": "10.0.0.1",
          "user_agent": "Mozilla/5.0"
        }
      }
  - Name: Non-matching event type
    ExpectedResult: false
    Log:
      {
        "id": "activity_01DEF456",
        "created_at": "2026-05-07T10:00:00Z",
        "organization_id": "org_01XYZ",
        "type": "org_user_invite_sent",
        "actor": {
          "type": "user_actor",
          "email_address": "admin@example.com",
          "user_id": "user_01ABC",
          "ip_address": "10.0.0.1"
        }
      }


# ------ paired body: anthropic_org_user_deleted.py ------

from panther_anthropic_helpers import anthropic_actor_id, anthropic_alert_context


def rule(event):
    return event.get("type") == "org_user_deleted"


def title(event):
    actor_email = anthropic_actor_id(event)
    deleted_user = event.get("deleted_user_email") or event.get("deleted_user_id", "<UNKNOWN_USER>")
    return f"Anthropic: User [{deleted_user}] deleted from org by [{actor_email}]"


def dedup(event):
    return anthropic_actor_id(event)


def alert_context(event):
    return anthropic_alert_context(event)