LoFP LoFP / developers, analysts, or knowledge workers bulk-uploading documents during migrations, evaluations, or large project onboarding can exceed the daily threshold from a single workstation or vpn egress.

Techniques

Sample rules

Anthropic High File Upload Activity

Description

Detects an unusually high volume of Claude file uploads from the same user email and source IP within a rolling 24-hour period. Sustained upload activity can indicate staging of sensitive documents in Claude chats for later retrieval, automated ingestion of data into LLM workflows, or abuse of organizational Claude access to move files into the cloud service.

Detection logic

from logs-anthropic.audit-*
| where
    data_stream.dataset == "anthropic.audit" and
    event.action == "claude_file_uploaded" and
    event.outcome == "success" and
    user.email is not null and
    source.ip is not null
| stats
    Esql.event_count = count(*),
    Esql.event_id_values = values(event.id),
    Esql.file_name_values = values(file.name),
    Esql.anthropic_audit_claude_file_id_values = values(anthropic.audit.claude_file_id),
    Esql.anthropic_audit_claude_chat_id_values = values(anthropic.audit.claude_chat_id),
    Esql.anthropic_audit_claude_project_id_values = values(anthropic.audit.claude_project_id),
    Esql.user_agent_original_values = values(user_agent.original),
    Esql.anthropic_audit_actor_type_values = values(anthropic.audit.actor.type),
    Esql.timestamp_first_seen = min(@timestamp),
    Esql.timestamp_last_seen = max(@timestamp)
  by user.email, source.ip
| where Esql.event_count >= 100
| keep user.email, source.ip, Esql.*