|
| 1 | +# Anthropic Compliance |
| 2 | + |
| 3 | +## Overview |
| 4 | + |
| 5 | +Datadog's Anthropic Compliance integration ingests audit activity logs from Anthropic's [Compliance API][1]. With this integration, security and compliance teams can: |
| 6 | + |
| 7 | +- **Monitor SSO sign-ins and authentication events** across your organization |
| 8 | +- **Track API key lifecycle** (creation, deletion, scope updates) for Admin, Platform, and Scoped API keys |
| 9 | +- **Audit Anthropic Console activity** including member invites, role changes, and workspace updates |
| 10 | +- **Investigate Claude usage** at the audit level (chat views, project access, file operations) |
| 11 | +- **Detect security-sensitive events** with the included Cloud SIEM detection rules |
| 12 | + |
| 13 | +The Compliance API is available to Anthropic Enterprise plan customers with the Compliance API enabled in their organization settings. |
| 14 | + |
| 15 | +## Setup |
| 16 | + |
| 17 | +### Prerequisites |
| 18 | + |
| 19 | +- An Anthropic **Enterprise plan** subscription |
| 20 | +- **Compliance API enabled** in Anthropic Organization settings under **Data and privacy** |
| 21 | +- An **Admin API key** (prefix `sk-ant-admin01-`) with the `read:compliance_activities` scope, or a dedicated **Compliance Access key** (prefix `sk-ant-api01-`) |
| 22 | + |
| 23 | +### 1. Enable the Compliance API in Anthropic |
| 24 | + |
| 25 | +1. Log in to the Anthropic Console as a Primary Owner. |
| 26 | +2. Navigate to **Organization settings -> Data and privacy**. |
| 27 | +3. Find the **Compliance API** section and click **Enable**. |
| 28 | + |
| 29 | +### 2. Generate or locate an Admin API key |
| 30 | + |
| 31 | +1. Navigate to **Organization settings -> API keys**. |
| 32 | +2. Generate a new Admin API key, or use the existing key already configured for the [Anthropic Usage and Costs][2] integration (the same key is reused). |
| 33 | +3. Copy the key to a secure location. |
| 34 | + |
| 35 | +### 3. Configure the Datadog integration |
| 36 | + |
| 37 | +1. In Datadog, go to [**Integrations -> Anthropic Compliance**](https://app.datadoghq.com/integrations?integrationId=anthropic-compliance-logs). |
| 38 | +2. In the configuration panel, paste your **Admin API Key**. |
| 39 | +3. Click **Save Configuration**. |
| 40 | + |
| 41 | +### 4. Validate |
| 42 | + |
| 43 | +1. Wait up to 5 minutes for the first crawl. |
| 44 | +2. Open [Log Explorer][3] and filter on `source:anthropic-compliance-logs`. |
| 45 | +3. Confirm logs appear with `evt.name` values such as `claude_chat_viewed`, `admin_api_key_created`, or `user_signed_in_sso`. |
| 46 | + |
| 47 | +## Data Collected |
| 48 | + |
| 49 | +### Logs |
| 50 | + |
| 51 | +The integration collects audit activity logs from `GET /v1/compliance/activities`. Each log includes: |
| 52 | + |
| 53 | +- A timestamp (`created_at`) with microsecond precision |
| 54 | +- An actor (user, API key, SCIM, or system) with email, user ID, IP address, and User-Agent when applicable |
| 55 | +- An activity `type` such as `user_signed_in_sso`, `admin_api_key_created`, `org_user_invite_accepted`, or `claude_chat_viewed` (150+ activity types across 35+ categories) |
| 56 | +- Organization and workspace context |
| 57 | + |
| 58 | +Logs are tagged `source:anthropic-compliance-logs` and processed by a Datadog log pipeline that flattens the actor object into standard `usr.*` and `network.client.*` attributes and enriches the source IP with GeoIP and the User-Agent string. |
| 59 | + |
| 60 | +### Metrics |
| 61 | + |
| 62 | +Anthropic Compliance does not include any metrics. |
| 63 | + |
| 64 | +### Service Checks |
| 65 | + |
| 66 | +Anthropic Compliance does not include any service checks. |
| 67 | + |
| 68 | +### Events |
| 69 | + |
| 70 | +Anthropic Compliance does not include any events. |
| 71 | + |
| 72 | +## Troubleshooting |
| 73 | + |
| 74 | +- **No logs after 10 minutes**: Verify the Compliance API is enabled in Anthropic Organization settings under Data and privacy. |
| 75 | +- **HTTP 403**: Confirm the Compliance API is enabled and that the Admin API key has the `read:compliance_activities` scope. |
| 76 | +- **Enterprise gate**: The Compliance API is only available on the Enterprise plan. |
| 77 | + |
| 78 | +Need help? Contact [Datadog support][4]. |
| 79 | + |
| 80 | +[1]: https://platform.claude.com/docs/en/api/compliance |
| 81 | +[2]: https://app.datadoghq.com/integrations?integrationId=anthropic-usage-and-costs |
| 82 | +[3]: https://app.datadoghq.com/logs?query=source%3Aanthropic-compliance-logs |
| 83 | +[4]: https://docs.datadoghq.com/help/ |
0 commit comments