Anthropic SSO Login Failed

AnalysisType: rule
RuleID: Anthropic.Activity.SSO.Login.Failed
DisplayName: "Anthropic SSO Login Failed"
Enabled: true
Filename: anthropic_sso_login_failed.py
LogTypes:
  - Anthropic.Activity
Severity: Medium
Description: >
  Detects failed SSO login attempts to the Anthropic organization. The actor
  is unauthenticated so no email is available — only the source IP. Every
  failure is alerted on as SSO failures should be rare in normal operation.
Runbook: |
  1. Find all Anthropic.Activity SSO events (sso_login_initiated, sso_login_succeeded, sso_login_failed) from actor:ip_address in the 1 hour before and after the alert to determine if this was a one-off or part of a burst
  2. Check if actor:ip_address appears in threat intelligence feeds or is associated with known VPN/proxy services
  3. Check if actor:ip_address has been seen in successful sso_login_succeeded events in the past 30 days to determine if this is a known user IP
Tags:
  - Anthropic
  - Authentication
Reports:
  MITRE ATT&CK:
    - TA0006:T1110  # Brute Force
Tests:
  - Name: SSO login failed
    ExpectedResult: true
    Log:
      {
        "id": "activity_01ABC123",
        "created_at": "2026-05-05T21:33:29Z",
        "organization_id": "org_01XYZ",
        "type": "sso_login_failed",
        "actor": {
          "type": "unauthenticated_user_actor",
          "ip_address": "192.168.1.1",
          "user_agent": "Mozilla/5.0"
        }
      }
  - Name: SSO login succeeded - not a match
    ExpectedResult: false
    Log:
      {
        "id": "activity_01DEF456",
        "created_at": "2026-05-05T21:33:29Z",
        "organization_id": "org_01XYZ",
        "type": "sso_login_succeeded",
        "actor": {
          "type": "user_actor",
          "email_address": "user@example.com",
          "user_id": "user_01ABC",
          "ip_address": "192.168.1.1"
        }
      }


# ------ paired body: anthropic_sso_login_failed.py ------

from panther_anthropic_helpers import anthropic_actor_id, anthropic_alert_context


def rule(event):
    return event.get("type") == "sso_login_failed"


def title(event):
    actor = anthropic_actor_id(event)
    return f"Anthropic: SSO login failed from [{actor}]"


def dedup(event):
    return anthropic_actor_id(event)


def alert_context(event):
    return anthropic_alert_context(event)