Skip to content

Commit 697bcd7

Browse files
TSwaimBVTSwaimBV
committed
BlueVoyant Anthropic ClaudeCompliance v3.0.0
1 parent 1b6ed93 commit 697bcd7

13 files changed

Lines changed: 1232 additions & 0 deletions

File tree

‎Logos/BlueVoyant.svg‎

Lines changed: 11 additions & 0 deletions
Loading

‎Solutions/BlueVoyant-Anthropic-ClaudeCompliance/Data Connectors/BV-ClaudeCompliance_ccf/dataConnectorDefinition.json‎

Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
{
2+
"type": "Microsoft.SecurityInsights/dataConnectorDefinitions",
3+
"apiVersion": "2022-09-01-preview",
4+
"name": "BV-ClaudeCompliance",
5+
"location": "{{location}}",
6+
"kind": "Customizable",
7+
"properties": {
8+
"connectorUiConfig": {
9+
"id": "BV-ClaudeCompliance",
10+
"title": "BV-ClaudeCompliance (via Codeless Connector Framework)",
11+
"publisher": "BlueVoyant",
12+
"descriptionMarkdown": "## BV-ClaudeCompliance (via Codeless Connector Framework)\r\n\r\nThis connector ingests **ClaudeCompliance** API data into Microsoft Sentinel using RestApiPoller.\r\n\r\n### Data Collection\r\n- Base API URL: `https://api.anthropic.com/`\r\n- Authentication: `APIKey`\r\n- Endpoint count: `1`\r\n\r\n### Tables\r\n- `ComplianceActivities` -> `BV_ClaudeCompliance_ComplianceActivities_CL`\r\n\r\n### Sample Query\r\n```kusto\r\nBV_ClaudeCompliance_ComplianceActivities_CL\r\n| take 10\r\n```",
13+
"graphQueriesTableName": "BV_ClaudeCompliance_ComplianceActivities_CL",
14+
"graphQueries": [
15+
{
16+
"metricName": "Total data received",
17+
"legend": "BV_ClaudeCompliance_ComplianceActivities_CL",
18+
"baseQuery": "{{graphQueriesTableName}}"
19+
}
20+
],
21+
"sampleQueries": [
22+
{
23+
"description": "All BV_ClaudeCompliance_ComplianceActivities_CL events",
24+
"query": "{{graphQueriesTableName}}\n| sort by TimeGenerated\n| take 10"
25+
}
26+
],
27+
"dataTypes": [
28+
{
29+
"name": "{{graphQueriesTableName}}",
30+
"lastDataReceivedQuery": "{{graphQueriesTableName}}\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)"
31+
}
32+
],
33+
"connectivityCriteria": [
34+
{
35+
"type": "HasDataConnectors"
36+
}
37+
],
38+
"availability": {
39+
"isPreview": false
40+
},
41+
"permissions": {
42+
"resourceProvider": [
43+
{
44+
"provider": "Microsoft.OperationalInsights/workspaces",
45+
"permissionsDisplayText": "Read and Write permissions are required.",
46+
"providerDisplayName": "Workspace",
47+
"scope": "Workspace",
48+
"requiredPermissions": {
49+
"write": true,
50+
"read": true,
51+
"delete": false
52+
}
53+
}
54+
]
55+
},
56+
"instructionSteps": [
57+
{
58+
"title": "Connect BV-ClaudeCompliance (via Codeless Connector Framework) to Microsoft Sentinel",
59+
"description": "To obtain a Claude Compliance API key, follow the instructions found here:\r\n[Access the Compliance API](https://support.claude.com/en/articles/13015708-access-the-compliance-api).\r\n\r\nThe API key must include the **`read:compliance_activities`** scope.\r\n\r\nPaste the key below and select **Connect**.",
60+
"instructions": [
61+
{
62+
"type": "Textbox",
63+
"parameters": {
64+
"label": "API Key",
65+
"placeholder": "Enter API key",
66+
"type": "password",
67+
"name": "apiKey",
68+
"validations": {
69+
"required": true
70+
}
71+
}
72+
},
73+
{
74+
"type": "ConnectionToggleButton",
75+
"parameters": {
76+
"connectLabel": "Connect",
77+
"disconnectLabel": "Disconnect",
78+
"name": "toggle"
79+
}
80+
}
81+
]
82+
}
83+
],
84+
"isConnectivityCriteriasMatchSome": false
85+
}
86+
}
87+
}

‎Solutions/BlueVoyant-Anthropic-ClaudeCompliance/Data Connectors/BV-ClaudeCompliance_ccf/dataConnectorPoller.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
[
2+
{
3+
"type": "Microsoft.SecurityInsights/dataConnectors",
4+
"apiVersion": "2022-10-01-preview",
5+
"name": "ComplianceActivities",
6+
"kind": "RestApiPoller",
7+
"properties": {
8+
"connectorDefinitionName": "BV-ClaudeCompliance",
9+
"dataType": "BV_ClaudeCompliance_ComplianceActivities_CL",
10+
"dcrConfig": {
11+
"streamName": "Custom-BV_ClaudeCompliance_ComplianceActivities_CL",
12+
"dataCollectionEndpoint": "{{dataCollectionEndpoint}}",
13+
"dataCollectionRuleImmutableId": "{{dataCollectionRuleImmutableId}}"
14+
},
15+
"auth": {
16+
"type": "APIKey",
17+
"ApiKey": "{{apiKey}}",
18+
"ApiKeyName": "x-api-key",
19+
"IsApiKeyInPostPayload": false
20+
},
21+
"request": {
22+
"apiEndpoint": "https://api.anthropic.com/v1/compliance/activities",
23+
"httpMethod": "GET",
24+
"queryWindowInMin": 10,
25+
"rateLimitQPS": 10,
26+
"timeoutInSeconds": 60,
27+
"retryCount": 3,
28+
"headers": {
29+
"User-Agent": "BV-ClaudeCompliance"
30+
},
31+
"startTimeAttributeName": "created_at.gte",
32+
"endTimeAttributeName": "created_at.lt",
33+
"queryTimeFormat": "yyyy-MM-ddTHH:mm:ssZ"
34+
},
35+
"response": {
36+
"eventsJsonPaths": [
37+
"$.data"
38+
],
39+
"format": "json"
40+
},
41+
"paging": {
42+
"pagingType": "NextPageToken",
43+
"pageSize": 5000,
44+
"pageSizeParameterName": "limit",
45+
"hasNextFlagJsonPath": "$.has_more",
46+
"pagingQueryParamOnly": false,
47+
"nextPageTokenJsonPath": "$.last_id",
48+
"nextPageParaName": "after_id"
49+
}
50+
}
51+
}
52+
]

‎Solutions/BlueVoyant-Anthropic-ClaudeCompliance/Data Connectors/BV-ClaudeCompliance_ccf/dcr.json‎

Lines changed: 105 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,105 @@
1+
[
2+
{
3+
"name": "DCR-BV-ClaudeCompliance",
4+
"apiVersion": "2021-09-01-preview",
5+
"type": "Microsoft.Insights/dataCollectionRules",
6+
"location": "{{location}}",
7+
"properties": {
8+
"dataCollectionEndpointId": "{{dataCollectionEndpointId}}",
9+
"streamDeclarations": {
10+
"Custom-BV_ClaudeCompliance_ComplianceActivities_CL": {
11+
"columns": [
12+
{
13+
"name": "TimeGenerated",
14+
"type": "datetime"
15+
},
16+
{
17+
"name": "actor",
18+
"type": "dynamic"
19+
},
20+
{
21+
"name": "claude_artifact_id",
22+
"type": "string"
23+
},
24+
{
25+
"name": "claude_chat_id",
26+
"type": "string"
27+
},
28+
{
29+
"name": "claude_file_id",
30+
"type": "string"
31+
},
32+
{
33+
"name": "claude_project_id",
34+
"type": "string"
35+
},
36+
{
37+
"name": "created_at",
38+
"type": "datetime"
39+
},
40+
{
41+
"name": "filename",
42+
"type": "string"
43+
},
44+
{
45+
"name": "id",
46+
"type": "string"
47+
},
48+
{
49+
"name": "organization_id",
50+
"type": "string"
51+
},
52+
{
53+
"name": "organization_uuid",
54+
"type": "string"
55+
},
56+
{
57+
"name": "request_body",
58+
"type": "string"
59+
},
60+
{
61+
"name": "request_id",
62+
"type": "string"
63+
},
64+
{
65+
"name": "request_method",
66+
"type": "string"
67+
},
68+
{
69+
"name": "status_code",
70+
"type": "int"
71+
},
72+
{
73+
"name": "type",
74+
"type": "string"
75+
},
76+
{
77+
"name": "url",
78+
"type": "string"
79+
}
80+
]
81+
}
82+
},
83+
"destinations": {
84+
"logAnalytics": [
85+
{
86+
"workspaceResourceId": "{{workspaceResourceId}}",
87+
"name": "clv2ws1"
88+
}
89+
]
90+
},
91+
"dataFlows": [
92+
{
93+
"streams": [
94+
"Custom-BV_ClaudeCompliance_ComplianceActivities_CL"
95+
],
96+
"destinations": [
97+
"clv2ws1"
98+
],
99+
"transformKql": "source | project-rename id_CF = ['id'], type_CF = ['type']",
100+
"outputStream": "Custom-BV_ClaudeCompliance_ComplianceActivities_CL"
101+
}
102+
]
103+
}
104+
}
105+
]

‎Solutions/BlueVoyant-Anthropic-ClaudeCompliance/Data Connectors/BV-ClaudeCompliance_ccf/table.json‎

Lines changed: 83 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
[
2+
{
3+
"name": "BV_ClaudeCompliance_ComplianceActivities_CL",
4+
"type": "Microsoft.OperationalInsights/workspaces/tables",
5+
"apiVersion": "2021-03-01-privatepreview",
6+
"properties": {
7+
"schema": {
8+
"name": "BV_ClaudeCompliance_ComplianceActivities_CL",
9+
"columns": [
10+
{
11+
"name": "TimeGenerated",
12+
"type": "datetime",
13+
"description": "Ingestion time"
14+
},
15+
{
16+
"name": "actor",
17+
"type": "dynamic"
18+
},
19+
{
20+
"name": "claude_artifact_id",
21+
"type": "string"
22+
},
23+
{
24+
"name": "claude_chat_id",
25+
"type": "string"
26+
},
27+
{
28+
"name": "claude_file_id",
29+
"type": "string"
30+
},
31+
{
32+
"name": "claude_project_id",
33+
"type": "string"
34+
},
35+
{
36+
"name": "created_at",
37+
"type": "datetime"
38+
},
39+
{
40+
"name": "filename",
41+
"type": "string"
42+
},
43+
{
44+
"name": "id_CF",
45+
"type": "string"
46+
},
47+
{
48+
"name": "organization_id",
49+
"type": "string"
50+
},
51+
{
52+
"name": "organization_uuid",
53+
"type": "string"
54+
},
55+
{
56+
"name": "request_body",
57+
"type": "string"
58+
},
59+
{
60+
"name": "request_id",
61+
"type": "string"
62+
},
63+
{
64+
"name": "request_method",
65+
"type": "string"
66+
},
67+
{
68+
"name": "status_code",
69+
"type": "int"
70+
},
71+
{
72+
"name": "type_CF",
73+
"type": "string"
74+
},
75+
{
76+
"name": "url",
77+
"type": "string"
78+
}
79+
]
80+
}
81+
}
82+
}
83+
]

‎Solutions/BlueVoyant-Anthropic-ClaudeCompliance/Data/Solution_BlueVoyant-Anthropic-ClaudeCompliance.json‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
{
2+
"Name": "BlueVoyant-Anthropic-ClaudeCompliance",
3+
"Author": "BlueVoyant - soc@bluevoyant.com",
4+
"Logo": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/BlueVoyant.svg\" width=\"75px\" height=\"75px\">",
5+
"Description": "The BlueVoyant Anthropic Claude Compliance solution for Microsoft Sentinel ingests compliance activity data from the Anthropic Claude Compliance API into your workspace. Using a Codeless Connector Framework (CCF) data connector, it continuously collects compliance events into the BV_ClaudeCompliance_ComplianceActivities_CL table for monitoring, hunting, and detection.",
6+
"Workbooks": [],
7+
"Analytic Rules": [],
8+
"Hunting Queries": [],
9+
"Data Connectors": [
10+
"Data Connectors/BV-ClaudeCompliance_ccf/dataConnectorDefinition.json"
11+
],
12+
"BasePath": "",
13+
"Version": "3.0.0",
14+
"Metadata": "SolutionMetadata.json",
15+
"TemplateSpec": true,
16+
"DataConnectorCCFVersion": "1.0.0"
17+
}

‎Solutions/BlueVoyant-Anthropic-ClaudeCompliance/Package/3.0.0.zip‎

6.38 KB
Binary file not shown.

0 commit comments

Comments
 (0)