Anthropic Organization Settings Updated

AnalysisType: rule
RuleID: Anthropic.Activity.Organization.Settings.Updated
DisplayName: "Anthropic Organization Settings Updated"
Enabled: true
Filename: anthropic_org_settings_updated.py
LogTypes:
  - Anthropic.Activity
Severity: Medium
Description: >
  Detects when organization-wide settings are modified in Anthropic. These changes
  can affect security posture for all users (e.g., SSO configuration, data retention,
  access controls). The updates field identifies which settings were changed.
Runbook: |
  1. Find all Anthropic.Activity events by actor:email_address in the 6 hours before and after the alert to understand what other administrative actions they performed
  2. Check if actor:email_address has performed claude_organization_settings_updated events in the past 90 days to determine if this is routine admin activity or a first-time action
  3. Check if actor:ip_address is associated with known VPN/proxy services or matches previously seen IP addresses for this actor
Tags:
  - Anthropic
  - Configuration
Reports:
  MITRE ATT&CK:
    - TA0005:T1562  # Impair Defenses
Tests:
  - Name: Org settings updated with updates field
    ExpectedResult: true
    Log:
      {
        "id": "activity_01ABC123",
        "created_at": "2026-04-29T09:14:15Z",
        "organization_id": "org_01XYZ",
        "type": "claude_organization_settings_updated",
        "updates": [{"type": "vcs_connections", "current_value": [{"org_name": "example-org", "type": "github"}]}],
        "actor": {
          "type": "user_actor",
          "email_address": "admin@example.com",
          "user_id": "user_01ABC",
          "ip_address": "10.0.0.1",
          "user_agent": "Mozilla/5.0"
        }
      }
  - Name: Non-matching event type
    ExpectedResult: false
    Log:
      {
        "id": "activity_01DEF456",
        "created_at": "2026-04-29T09:14:15Z",
        "organization_id": "org_01XYZ",
        "type": "claude_user_settings_updated",
        "actor": {
          "type": "user_actor",
          "email_address": "user@example.com",
          "user_id": "user_01DEF",
          "ip_address": "10.0.0.2"
        }
      }


# ------ paired body: anthropic_org_settings_updated.py ------

import re

from panther_anthropic_helpers import anthropic_actor_id, anthropic_alert_context

PARENT_EVENT_TYPE = "claude_organization_settings_updated"


def rule(event):
    return event.get("type") == PARENT_EVENT_TYPE


def _extract_update_type(entry_str):
    """Extract the first type value from a single serialized update entry."""
    match = re.search(r"'type':\s*'([^']+)'", entry_str)
    if not match:
        match = re.search(r'"type":\s*"([^"]+)"', entry_str)
    return match.group(1) if match else None


def _extract_update_types(updates):
    """Extract top-level update type values from the updates list.

    Serializes each entry individually to avoid capturing type values
    from nested objects. Uses string parsing because Panther's event
    wrapper intercepts .get("type") on nested objects.
    """
    result = []
    for entry in updates:
        update_type = _extract_update_type(str(entry))
        if update_type and update_type != PARENT_EVENT_TYPE:
            result.append(update_type)
    return result


def title(event):
    actor_email = anthropic_actor_id(event)
    updates = event.get("updates", [])
    if updates:
        update_types = _extract_update_types(updates)
        if update_types:
            types_str = ", ".join(update_types)
            return f"Anthropic: Organization settings updated by" f" [{actor_email}]: {types_str}"
    return f"Anthropic: Organization settings updated by [{actor_email}]"


def dedup(event):
    return anthropic_actor_id(event)


def alert_context(event):
    return anthropic_alert_context(event)