Panther medium experimental python

Anthropic Admin API Key Deleted

Detects when an admin API key is deleted. Unauthorized deletion could indicate an attacker revoking legitimate credentials to disrupt operations or covering tracks after using a compromised key.

View Source

Detection Logic

from panther_anthropic_helpers import anthropic_actor_id, anthropic_alert_context


def rule(event):
    return event.get("type") == "admin_api_key_deleted"


def title(event):
    actor_email = anthropic_actor_id(event)
    return f"Anthropic: Admin API key deleted by [{actor_email}]"


def dedup(event):
    return anthropic_actor_id(event)


def alert_context(event):
    return anthropic_alert_context(event)

Field Validations

Loading…

Comments (0)

Loading comments...