> For the complete documentation index, see [llms.txt](https://docs.expel.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.expel.io/detection-strategy-guides/a-c/anthropic-claude.ai-enterprise-via-compliance-api-detection-strategy.md). # Anthropic Claude.ai Enterprise via Compliance API Detection Strategy ## Product Overview Anthropic Claude App (Claude.AI) Enterprise is a tool that provides artificial intelligence (AI) productivity tooling as a service. Claude App is a popular option for enterprises leveraging the power of AI to boost productivity and efficiency for their employees in their organizations. Although organizations using AI products don’t have to worry about managing infrastructure, security is still a shared responsibility between Anthropic and their customers. Anthropic is responsible for physical security and ensuring their models and applications have necessary guardrails and built in safety checks. Organizations are responsible for ensuring they are not putting their users and data at risk with insecure configurations or compromised credentials. The Anthropic Claude App Enterprise detection and response strategy aims to help organizations gain visibility into active threats that must be remediated. Additionally, Expel provides resilience recommendations that help organizations lock down the platform and reduce the risk of a compromise. Expel collects data through direct Claude Compliance API integration. This integration allows Expel to collect activity fields and chat messages for detection and response. ## Detection Strategy for Claude.AI ### Detection Our AI detection strategy is designed to identify and respond to suspicious user activity across AI infrastructure directly, as well as through direct integration with endpoint product AI add-on modules. By integrating directly with AI infrastructure, we continuously monitor user behavior and focus on activities such as unusual administrator configuration activity, modification of guardrails, abuse of the agent harness, or prompt abuse. These events are processed through our detection engine, which leverages behavioral analytics and threat intelligence to flag AI exploitation activity. Anthropic does not provide native alerting for its tools. Expel will alert for the following for Claude.AI: * Destructive and/or irreversible actions by administrators against an organization’s Claude instances. * Behaviors which may indicate suspicious activity such as data exfiltration attempts, privilege escalation, malicious instructions being uploaded, or agent memory poisoning attempts. If this activity is seen coming from potentially suspicious infrastructure such as an anonymizing proxy or malicious IP address or domain, it will become an Expel alert. * Optional DUET notifications for Unsanctioned Model Context Protocol (MCP) servers, Plugins, or Claude skills. We extend our endpoint detection strategy to detect suspected malicious activity in the agent harness. By integrating directly with EDR vendors, we can process security alerts to extract evidence and normalize event details observed during the runtime activity of an agent on a device. These normalized signals are then processed through our detection engine to look for signs of post-exploitation activity. When a threat or anomaly is detected, our automated response bot, Ruxie, takes action by enriching evidence fields with first- and third-party threat intelligence. Additional Ruxie actions query a wide span of technologies directly to arm analysts with key pieces of investigative information and related events. ### Response Integrations with AI infrastructure and endpoints provide rich context for processes and also support other types of Expel Alerts. For example, we use source device identification across a number of alert types when a source IP or hostname is available, because it provides rich context about the actor behind the activity. Additionally, AI infrastructure and endpoints provide valuable information for network alerts to help identify which process triggered a connection. To learn more about our overall approach to detection strategy, see [About Detection Strategy](/workbench-reference/detections/about-detection-strategy.md). ## What We Support for Anthropic Claude.ai Enterprise To see a comprehensive list of the most up-to-date Expel detection rules, vendor detection rules, opt-in detections, and available DUETs (**d**id yo**u** **e**xpect **t**his) that we support for Anthropic Claude.ai Enterprise, you can visit the [Detections page](https://workbench.expel.io/tools/detections/all?filter=%7B%22supportedTech%22%3A%7B%22is%22%3A%5B%22anthropic%3A1.0.0%22%5D%7D%7D) in Workbench or ask your Sales or Support rep for the most recent download. | **Supported event log sources** | | | ---------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Anthropic Claude.ai Enterprise detection rules support** | No native Anthropic detection support exists. | | **Detection rules written by Expel** | Yes. | | **Investigative support through Workbench** |

Yes. We are able to take the following investigative actions to gather data for triage and investigation of events:

| | **Hunting support** | No. Hunting is not currently available for this integration. | ## Additional Details and Common Questions ### DUET A DUET rule flags certain events as needing an immediate verification or notification, and bypasses the normal internal event triage process. The events subject to DUET rules contain behaviors that are not typically indicative of true security incidents, as they are related to policy violations or potential risk. There are a number of workflows that a DUET may follow. When enabled, the activity will be flagged for investigation and will be routed to you (rather than to us) to take a specified first action. To see the specific DUET rules currently supported for this integration, visit the [Detections page](https://workbench.expel.io/tools/detections/all) in Workbench. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.expel.io/detection-strategy-guides/a-c/anthropic-claude.ai-enterprise-via-compliance-api-detection-strategy.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.