Panther medium experimental python

Anthropic Spend Limit Deleted

Detects when a platform spend limit is deleted. A deleted spend limit without a subsequent recreate could indicate an attacker removing financial guardrails to enable large-scale API usage or data exfiltration. Note that normal admin workflow often involves a delete immediately followed by a create (editing a limit).

View Source

Detection Logic

from panther_anthropic_helpers import anthropic_actor_id, anthropic_alert_context


def rule(event):
    return event.get("type") == "platform_spend_limit_deleted"


def title(event):
    actor_email = anthropic_actor_id(event)
    return f"Anthropic: Platform spend limit deleted by [{actor_email}]"


def dedup(event):
    return anthropic_actor_id(event)


def alert_context(event):
    return anthropic_alert_context(event)

Field Validations

Loading…

Comments (0)

Loading comments...