« Anthropic Excessive Chat Snapshot Creation Anthropic High File Upload Activity »
Elastic Docs ›Elastic Security [8.19] ›Detections and alerts ›Prebuilt rule reference

Anthropic Extra Usage Spend Limit Deleted

edit
IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

Anthropic Extra Usage Spend Limit Deleted

edit

Extra usage spend limits cap Anthropic organizational spend beyond included usage. Deleting a spend limit removes that cap and can enable unrestricted API or Claude consumption. An attacker who already has administrative or API access can delete the limit to burn budget, run large automated workloads, or stage resource abuse without the previous guardrail.

Rule type: esql

Rule indices: None

Severity: medium

Risk score: 47

Runs every: 5m

Searches indices from: now-9m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

Tags:

  • Domain: GenAI
  • Platform: Anthropic
  • Data Source: Anthropic Audit Logs
  • Use Case: Threat Detection
  • Resources: Investigation Guide
  • Rule Type: ES|QL
  • Tactic: Impact

Version: 1

Rule authors:

  • Elastic

Rule license: Elastic License v2

Investigation guide

edit

Triage and analysis

Investigating Anthropic Extra Usage Spend Limit Deleted

Deleting an extra-usage spend limit removes a billing guardrail; it does not create spend by itself. Treat it as an early signal for follow-on quota burn or automated workloads.

Unauthorized = no finance/platform ticket to redesign billing, and no nearby extra_usage_spend_limit_created / extra_usage_spend_limit_updated that replaces the deleted limit — especially if high chat creation or file uploads follow.

Possible investigation steps

  • Branch on actor: user_actor → user.email / source.ip / UA; api_actor → anthropic.audit.actor.api_key_id and whether that key is in inventory.
  • Check for create/update of a replacement limit within the same change window (planned redesign) vs standalone deletion.
  • After the delete, look for elevated claude_chat_created, file uploads, or other high-volume activity on the same organization.id.
  • Close as FP when a finance/platform ticket names the redesign and a replacement create/update exists. Escalate when deletion is orphaned or usage spikes afterward.

False positive analysis

  • Billing consolidations often delete an old limit shortly before creating a new one.

Response and remediation

  • On unauthorized deletion: restore an appropriate spend limit, review API keys and admin sessions active during the exposure window, and quantify extra usage accrued after the change.

Rule query

edit
from logs-anthropic.audit-* metadata _id, _version, _index
| where
    data_stream.dataset == "anthropic.audit" and
    mv_contains(event.category, "configuration") and
    event.action == "extra_usage_spend_limit_deleted"
| keep _id, _version, _index, @timestamp, event.*, organization.*, user.*, source.*, user_agent.*, anthropic.audit.*, data_stream.*

Framework: MITRE ATT&CKTM

« Anthropic Excessive Chat Snapshot Creation Anthropic High File Upload Activity »