Anthropic SSO Disabled

AnalysisType: rule
RuleID: Anthropic.Activity.SSO.Disabled
DisplayName: "Anthropic SSO Disabled"
Enabled: true
Filename: anthropic_sso_disabled.py
LogTypes:
  - Anthropic.Activity
Severity: High
Description: >
  Detects when SSO is disabled or an SSO connection is deactivated for the
  organization. Disabling SSO allows users to bypass the identity provider
  and use weaker authentication methods. This is a critical security posture
  change that could indicate an attacker attempting to maintain access
  without IdP visibility.
Runbook: |
  1. Find all Anthropic.Activity events by actor:email_address in the 24 hours before the alert to identify any suspicious activity leading up to the SSO change
  2. Check if actor:ip_address matches previously seen IP addresses for this actor in the past 30 days to detect potential account compromise
  3. Find all SSO-related events (sso_login_failed, sso_login_initiated, sso_login_succeeded) in the 1 hour before and after the alert to understand the authentication context
Tags:
  - Anthropic
  - Authentication
  - Defense Evasion
Reports:
  MITRE ATT&CK:
    - TA0005:T1562.001  # Impair Defenses: Disable or Modify Tools
Tests:
  - Name: SSO toggled off
    ExpectedResult: true
    Log:
      {
        "id": "activity_01ABC123",
        "created_at": "2026-05-07T10:00:00Z",
        "organization_id": "org_01XYZ",
        "type": "org_sso_toggled",
        "is_enabled": false,
        "actor": {
          "type": "user_actor",
          "email_address": "admin@example.com",
          "user_id": "user_01ABC",
          "ip_address": "10.0.0.1",
          "user_agent": "Mozilla/5.0"
        }
      }
  - Name: SSO toggled on - not a match
    ExpectedResult: false
    Log:
      {
        "id": "activity_01DEF456",
        "created_at": "2026-05-07T10:00:00Z",
        "organization_id": "org_01XYZ",
        "type": "org_sso_toggled",
        "is_enabled": true,
        "actor": {
          "type": "user_actor",
          "email_address": "admin@example.com",
          "user_id": "user_01ABC",
          "ip_address": "10.0.0.1"
        }
      }
  - Name: SSO connection deactivated
    ExpectedResult: true
    Log:
      {
        "id": "activity_01GHI789",
        "created_at": "2026-05-07T10:00:00Z",
        "organization_id": "org_01XYZ",
        "type": "org_sso_connection_deactivated",
        "actor": {
          "type": "user_actor",
          "email_address": "admin@example.com",
          "user_id": "user_01GHI",
          "ip_address": "10.0.0.3",
          "user_agent": "Mozilla/5.0"
        }
      }
  - Name: Non-matching event type
    ExpectedResult: false
    Log:
      {
        "id": "activity_01JKL012",
        "created_at": "2026-05-07T10:00:00Z",
        "organization_id": "org_01XYZ",
        "type": "sso_login_succeeded",
        "actor": {
          "type": "user_actor",
          "email_address": "user@example.com",
          "user_id": "user_01JKL",
          "ip_address": "10.0.0.4"
        }
      }


# ------ paired body: anthropic_sso_disabled.py ------

from panther_anthropic_helpers import anthropic_actor_id, anthropic_alert_context


def rule(event):
    event_type = event.get("type")
    if event_type == "org_sso_toggled":
        return event.get("is_enabled") in (False, "false")
    if event_type == "org_sso_connection_deactivated":
        return True
    return False


def title(event):
    actor_email = anthropic_actor_id(event)
    event_type = event.get("type")
    if event_type == "org_sso_toggled":
        return f"Anthropic: SSO disabled by [{actor_email}]"
    return f"Anthropic: SSO connection deactivated by [{actor_email}]"


def dedup(event):
    return anthropic_actor_id(event)


def alert_context(event):
    return anthropic_alert_context(event)