Anthropic Primary Owner Transferred

AnalysisType: rule
RuleID: Anthropic.Activity.Primary.Owner.Transferred
DisplayName: "Anthropic Primary Owner Transferred"
Enabled: true
Filename: anthropic_primary_owner_transferred.py
LogTypes:
  - Anthropic.Activity
Severity: High
Description: >
  Detects when the primary owner role of the Anthropic organization is
  transferred to another member. This is an extremely high-privilege action
  that gives full control of the organization. The previous_owner_id and
  new_owner_id fields identify who gave up and received ownership.
Runbook: |
  1. Find all Anthropic.Activity events by actor:email_address in the 24 hours before the alert to identify any suspicious activity leading up to the ownership transfer
  2. Check if actor:ip_address matches previously seen IP addresses for this actor in the past 30 days to detect potential account compromise
  3. Find all alerts for actor:email_address in the past 7 days to check for signs of account compromise preceding this action
Tags:
  - Anthropic
  - Privilege Escalation
Reports:
  MITRE ATT&CK:
    - TA0003:T1098.003  # Account Manipulation: Additional Cloud Roles
Tests:
  - Name: Primary owner transferred
    ExpectedResult: true
    Log:
      {
        "id": "activity_01ABC123",
        "created_at": "2026-05-07T10:00:00Z",
        "organization_id": "org_01XYZ",
        "type": "primary_owner_transferred",
        "actor": {
          "type": "user_actor",
          "email_address": "owner@example.com",
          "user_id": "user_01ABC",
          "ip_address": "10.0.0.1",
          "user_agent": "Mozilla/5.0"
        }
      }
  - Name: Non-matching event type
    ExpectedResult: false
    Log:
      {
        "id": "activity_01DEF456",
        "created_at": "2026-05-07T10:00:00Z",
        "organization_id": "org_01XYZ",
        "type": "role_assignment_granted",
        "actor": {
          "type": "user_actor",
          "email_address": "admin@example.com",
          "user_id": "user_01DEF",
          "ip_address": "10.0.0.2"
        }
      }


# ------ paired body: anthropic_primary_owner_transferred.py ------

from panther_anthropic_helpers import anthropic_actor_id, anthropic_alert_context


def rule(event):
    return event.get("type") == "primary_owner_transferred"


def title(event):
    actor_email = anthropic_actor_id(event)
    return f"Anthropic: Primary owner transferred by [{actor_email}]"


def dedup(event):
    return anthropic_actor_id(event)


def alert_context(event):
    return anthropic_alert_context(event)