Panther informational experimental python

Anthropic Role Granted

Tracks all role grants in the Anthropic organization. Currently used to build visibility into the role taxonomy as the log source matures. Once sufficient data is collected on org-level vs project-level role patterns, this rule can be refined to alert at higher severity for elevated roles.

View Source

Detection Logic

from panther_anthropic_helpers import anthropic_actor_id, anthropic_alert_context


def rule(event):
    return event.get("type") == "role_assignment_granted"


def title(event):
    actor_email = anthropic_actor_id(event)
    role = event.get("role", "<UNKNOWN_ROLE>")
    target_id = event.get("target_id", "<UNKNOWN_TARGET>")
    return f"Anthropic: Role [{role}] granted to [{target_id}] by [{actor_email}]"


def dedup(event):
    return anthropic_actor_id(event)


def alert_context(event):
    return anthropic_alert_context(event)

Field Validations

Loading…

Comments (0)

Loading comments...