Anthropic Claude

Designed to assist security professionals with security investigations, threat hunting, and anomaly detection, leveraging Anthropic Claude's natural language conversational capabilities.

Messaging and Conferencing · Anthropic Claude

Details

ID	`Anthropic Claude`
Provider	Anthropic
Category	Messaging and Conferencing
From Version	6.0.0
Docker Image	`demisto/parse-emails:0.1.48.10569905`
Supported Modules	Agentix XSIAM

README

Designed to assist security professionals with security investigations, threat hunting, and anomaly detection, leveraging Anthropic Claude’s natural language conversational capabilities.

Configure Anthropic Claude on Cortex XSOAR

Navigate to Settings > Integrations > Servers & Services.
Search for Anthropic Claude.
Click Add instance to create and configure a new integration instance.

Parameter	Description	Required
Server URL		True
API Key	Anthropic API Key used for the LLM commands (claude-send-message, claude-check-email-*, claude-create-soc-email-template). Generate one at https://console.anthropic.com/keys.	False
Model	The model that will process the inputs and generate the response.	False
Model (Optional - overrides selected choice)	The model that will process the inputs and generate the response.	False
Max tokens	The maximum number of tokens that can be generated for the response. Required by Anthropic’s API (defaults to 1024).	True
Temperature	Sets the randomness in responses. Lower values (closer to 0) produce more deterministic and consistent outputs, while higher values (up to 1) increase randomness and variety.	False
Top P	Enables nucleus sampling where only the top ‘p’ percent (0 to 1) of probable tokens are considered. Lower values result in more focused outputs, while higher values increase diversity.	False
Compliance Access Key	Anthropic Compliance Access Key (sk-ant-api01-…) used for event collection and the read-only compliance commands. Required to fetch events and to run the claude-list-* / claude-get-* commands.	False
Organization UUID	The default Organization UUID to use for compliance commands that accept an org_uuid argument. The command argument overrides this value when provided.	False
Fetch events		False
Activity types	A comma-separated list of Activity Feed types to narrow the feed (e.g., user.login,chat.created). Leave empty to fetch all activity types. See the available activity types here: https://platform.claude.com/docs/en/api/compliance/activities/list.	False
Maximum number of events per fetch	The maximum number of events to fetch per cycle. Defaults to 50000 (5000 x 10 calls).	False
Trust any certificate (not secure)		False
Use system proxy settings		False

Click Test to validate the URLs, token, and connection.

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

claude-send-message

Send a plain message to the selected Claude model and receive the generated response.

Base Command

claude-send-message

Input

Argument Name	Description	Required
message	The message that the Claude model will respond to.	Required
reset_conversation_history	Whether to keep previously sent messages in a conversation context or start a new conversation. Possible values are: yes, no.	Optional
max_tokens	The maximum number of tokens that can be generated for the response.	Optional
temperature	Sets the randomness in responses. Lower values (closer to 0) produce more deterministic and consistent outputs, while higher values (up to 1) increase randomness and variety.	Optional
top_p	(0-1) Enables nucleus sampling where only the top ‘p’ percent of probable tokens are considered. Lower values result in more focused outputs, while higher values increase diversity.	Optional

Context Output

Path	Type	Description
AnthropicClaude.Conversation	Dictionary	Entire conversation (if not reset) between the user and the Claude model.

claude-check-email-header

Checking email header for possible security issues. It is possible to keep asking questions on the provided info using ‘claude-send-message’. Resets conversation context by default.

Base Command

claude-check-email-header

Input

Argument Name	Description	Required
entry_id	Entry ID of an uploaded ‘.eml’ file.	Required
additional_instructions	Additional instructions or security issue to focus on.	Optional
max_tokens	The maximum number of tokens that can be generated for the response.	Optional
temperature	Sets the randomness in responses. Lower values (closer to 0) produce more deterministic and consistent outputs, while higher values (up to 1) increase randomness and variety.	Optional
top_p	Enables nucleus sampling where only the top ‘p’ percent of probable tokens are considered. Lower values result in more focused outputs, while higher values increase diversity.	Optional

Context Output

Path	Type	Description
AnthropicClaude.Conversation	Dictionary	Entire conversation (if not reset) between the user and the Claude model.

claude-check-email-body

Check email body for possible security issues. It is possible to keep asking questions on the provided info using ‘claude-send-message’. Resets conversation context by default.

Base Command

claude-check-email-body

Input

Argument Name	Description	Required
entry_id	Entry ID of an uploaded ‘.eml’ file.	Required
additional_instructions	Additional instructions or security issue to focus on.	Optional
max_tokens	The maximum number of tokens that can be generated for the response.	Optional
temperature	Sets the randomness in responses. Lower values (closer to 0) produce more deterministic and consistent outputs, while higher values (up to 1) increase randomness and variety.	Optional
top_p	Enables nucleus sampling where only the top ‘p’ percent of probable tokens are considered. Lower values result in more focused outputs, while higher values increase diversity.	Optional

Context Output

Path	Type	Description
AnthropicClaude.Conversation	Dictionary	Entire conversation (if not reset) between the user and the Claude model.

claude-create-soc-email-template

Create an email template out of the conversation context to be sent from the SOC.

Base Command

claude-create-soc-email-template

Input

Argument Name	Description	Required
additional_instructions	Additional instructions or security issue to focus on.	Optional
max_tokens	The maximum number of tokens that can be generated for the response.	Optional
temperature	Sets the randomness in responses. Lower values (closer to 0) produce more deterministic and consistent outputs, while higher values (up to 1) increase randomness and variety.	Optional
top_p	Enables nucleus sampling where only the top ‘p’ percent of probable tokens are considered. Lower values result in more focused outputs, while higher values increase diversity.	Optional

Context Output

Path	Type	Description
AnthropicClaude.Conversation	Dictionary	Entire conversation (if not reset) between the user and the Claude model.

claude-list-chats

List chats metadata (Compliance API).

Base Command

claude-list-chats

Input

Argument Name	Description	Required
user_ids	Up to 10 user IDs. Run claude-list-organization-users first to obtain them.	Required
organization_ids	Filter by organization UUID(s).	Optional
project_ids	Filter by project ID(s).	Optional
created_at_gte	RFC 3339 lower bound on creation time (example: 2025-06-07T08:09:10Z).	Optional
created_at_lte	RFC 3339 upper bound on creation time.	Optional
updated_at_gte	RFC 3339 lower bound on update time.	Optional
updated_at_lte	RFC 3339 upper bound on update time.	Optional
limit	Page size.	Optional
after_id	Cursor - walk toward newer chats.	Optional
before_id	Cursor - walk toward older chats.	Optional

Context Output

Path	Type	Description
AnthropicClaude.Chat.id	String	The chat ID.
AnthropicClaude.Chat.name	String	The chat name.
AnthropicClaude.Chat.created_at	Date	The chat creation time.
AnthropicClaude.Chat.updated_at	Date	The chat update time.
AnthropicClaude.Chat.model	String	The model used in the chat.
AnthropicClaude.Chat.organization_uuid	String	The organization UUID.
AnthropicClaude.Chat.project_id	String	The project ID.

claude-list-groups

List groups, or retrieve a single group when group_id is provided (Compliance API).

Base Command

claude-list-groups

Input

Argument Name	Description	Required
group_id	When provided, returns that single group instead of the list.	Optional
limit	Page size (list mode only).	Optional
next_token	Page token (list mode only).	Optional

Context Output

Path	Type	Description
AnthropicClaude.Group.id	String	The group ID.
AnthropicClaude.Group.name	String	The group name.
AnthropicClaude.Group.description	String	The group description.
AnthropicClaude.Group.source_type	String	The group source type (direct or scim).
AnthropicClaude.Group.roles	Unknown	Array of role IDs assigned to the group.
AnthropicClaude.Group.created_at	Date	The group creation time.
AnthropicClaude.Group.updated_at	Date	The group update time.

claude-get-events

Manually retrieve Activity Feed events from the Anthropic Compliance API for testing and troubleshooting.

Base Command

claude-get-events

Input

Argument Name	Description	Required
limit	Maximum number of events to retrieve. Default is 50.	Optional
should_push_events	If true, the events are pushed to Cortex XSIAM. Possible values are: true, false. Default is false.	Optional
activity_types	A comma-separated list of Activity Feed types to narrow the feed.	Optional

Context Output

There is no context output for this command.

claude-list-roles

List roles of an organization, or retrieve a single role when role_id is provided (Compliance API).

Base Command

claude-list-roles

Input

Argument Name	Description	Required
org_uuid	Organization UUID. Overrides the instance Organization UUID parameter when provided.	Optional
role_id	When provided, returns that single role instead of the list.	Optional
limit	Maximum number of roles to return. Maximum: 1000. Default is 50.	Optional
next_token	Page token (list mode only).	Optional

Context Output

Path	Type	Description
AnthropicClaude.Organization.Role.id	String	The role ID.
AnthropicClaude.Organization.Role.name	String	The role name.
AnthropicClaude.Organization.Role.description	String	The role description.
AnthropicClaude.Organization.Role.created_at	Date	The role creation time.
AnthropicClaude.Organization.Role.updated_at	Date	The role update time.

claude-list-projects

List projects, or retrieve a single project when project_id is provided (Compliance API).

Base Command

claude-list-projects

Input

Argument Name	Description	Required
project_id	When provided, returns that single project instead of the list.	Optional
limit	Maximum number of projects to return. Maximum: 100. Default is 50.	Optional
next_token	Page token (list mode only).	Optional

Context Output

Path	Type	Description
AnthropicClaude.Project.id	String	The project ID.
AnthropicClaude.Project.name	String	The project name.
AnthropicClaude.Project.is_private	Boolean	Whether the project is private.
AnthropicClaude.Project.organization_uuid	String	The organization UUID.
AnthropicClaude.Project.created_at	Date	The project creation time.
AnthropicClaude.Project.updated_at	Date	The project update time.

claude-list-project-attachments

List the attachments of a project (Compliance API).

Base Command

claude-list-project-attachments

Input

Argument Name	Description	Required
project_id	Project ID.	Required
next_token	Page token.	Optional

Context Output

Path	Type	Description
AnthropicClaude.Project.Attachment.id	String	The attachment ID.
AnthropicClaude.Project.Attachment.filename	String	The attachment filename.
AnthropicClaude.Project.Attachment.mime_type	String	The attachment MIME type.
AnthropicClaude.Project.Attachment.type	String	The attachment type (project_file or project_doc).
AnthropicClaude.Project.Attachment.created_at	Date	The attachment creation time.

claude-list-organization-users

List the users of an organization (Compliance API).

Base Command

claude-list-organization-users

Input

Argument Name	Description	Required
org_uuid	Organization UUID. Overrides the instance Organization UUID parameter when provided.	Optional
limit	Maximum number of users to return. Maximum: 1000. Default is 50.	Optional
next_token	Page token from a previous response’s next_page.	Optional

Context Output

Path	Type	Description
AnthropicClaude.Organization.User.id	String	The user ID.
AnthropicClaude.Organization.User.full_name	String	The user full name.
AnthropicClaude.Organization.User.email	String	The user email.
AnthropicClaude.Organization.User.organization_role	String	The user’s role in the organization.
AnthropicClaude.Organization.User.created_at	Date	The user creation time.

claude-list-role-permissions

List the permissions of a role (Compliance API).

Base Command

claude-list-role-permissions

Input

Argument Name	Description	Required
org_uuid	Organization UUID. Overrides the instance Organization UUID parameter when provided.	Optional
role_id	Role ID.	Required
limit	Maximum number of permissions to return. Maximum: 1000. Default is 50.	Optional
next_token	Page token.	Optional

Context Output

Path	Type	Description
AnthropicClaude.Organization.Role.Permission.resource_type	String	The permission resource type.
AnthropicClaude.Organization.Role.Permission.resource_id	String	The permission resource ID.
AnthropicClaude.Organization.Role.Permission.action	String	The permission action.

claude-list-group-members

List the members of a group (Compliance API).

Base Command

claude-list-group-members

Input

Argument Name	Description	Required
group_id	Group ID.	Required
limit	Maximum number of members to return. Maximum: 1000. Default is 50.	Optional
next_token	Page token.	Optional

Context Output

Path	Type	Description
AnthropicClaude.Group.Member.user_id	String	The member user ID.
AnthropicClaude.Group.Member.email	String	The member email.
AnthropicClaude.Group.Member.created_at	Date	The membership creation time.
AnthropicClaude.Group.Member.updated_at	Date	The membership update time.

claude-get-project-document

Retrieve a project document including its text content (Compliance API).

Base Command

claude-get-project-document

Input

Argument Name	Description	Required
project_id	Project ID.	Required
document_id	Project document ID.	Required

Context Output

Path	Type	Description
AnthropicClaude.ProjectDocument.id	String	The document ID.
AnthropicClaude.ProjectDocument.filename	String	The document filename.
AnthropicClaude.ProjectDocument.mime_type	String	The document MIME type.
AnthropicClaude.ProjectDocument.created_at	Date	The document creation time.
AnthropicClaude.ProjectDocument.content	String	The document text content.

claude-list-organizations

List the organizations under the parent organization (Compliance API).

Base Command

claude-list-organizations

Input

Argument Name	Description	Required
limit	Client-side cap on the number of organizations returned. Maximum: 1000. Default is 50.	Optional

Context Output

Path	Type	Description
AnthropicClaude.Organization.uuid	String	The organization UUID.
AnthropicClaude.Organization.name	String	The organization name.
AnthropicClaude.Organization.created_at	Date	The organization creation time.

claude-list-chat-messages

List the messages of a chat (Compliance API).

Base Command

claude-list-chat-messages

Input

Argument Name	Description	Required
chat_id	Chat ID.	Required
limit	Maximum number of messages to return. Maximum: 1000. Default is 50.	Optional
after_id	Cursor.	Optional
before_id	Cursor.	Optional
order	Sort direction. Possible values are: asc, desc.	Optional
created_at_gte	RFC 3339 lower bound on creation time.	Optional
created_at_lte	RFC 3339 upper bound on creation time.	Optional
updated_at_gte	RFC 3339 lower bound on update time.	Optional
updated_at_lte	RFC 3339 upper bound on update time.	Optional

Context Output

Path	Type	Description
AnthropicClaude.Chat.Message.id	String	The message ID.
AnthropicClaude.Chat.Message.role	String	The message role (user or assistant).
AnthropicClaude.Chat.Message.created_at	Date	The message creation time.

claude-chat-file-delete

Permanently delete a Claude file (a conversation file or a project binary file) via the Compliance API. This is an irreversible hard delete, and it requires a Compliance Access Key with the delete:compliance_user_data scope. Deleting an already-deleted or unknown file ID succeeds (idempotent).

Base Command

claude-chat-file-delete

Input

Argument Name	Description	Required
file_id	The Claude file ID to permanently delete (e.g., claude_file_…). Deletes a file uploaded in a conversation or a project binary file (project_file). This is an irreversible hard delete.	Required

Context Output

Path	Type	Description
AnthropicClaude.DeletedFile.id	String	The ID of the file that was deleted.
AnthropicClaude.DeletedFile.type	String	The deletion confirmation type (claude_file_deleted).
AnthropicClaude.DeletedFile.Deleted	Boolean	The deletion result for the file (true when deleted).

Command example

!claude-chat-file-delete file_id=claude_file_011CbqYrHZoNLmjzW2AC53fK

Context Example

{
    "AnthropicClaude": {
        "DeletedFile": {
            "Deleted": true,
            "id": "claude_file_011CbqYrHZoNLmjzW2AC53fK",
            "type": "claude_file_deleted"
        }
    }
}

Human Readable Output

File deleted

id type Deleted

claude_file_011CbqYrHZoNLmjzW2AC53fK claude_file_deleted true

id	type	Deleted
claude_file_011CbqYrHZoNLmjzW2AC53fK	claude_file_deleted	true

claude-project-document-delete

Permanently delete a Claude project document (a plain-text project_doc) via the Compliance API. This is an irreversible hard delete, and it requires a Compliance Access Key with the delete:compliance_user_data scope. Deleting an already-deleted or unknown document ID succeeds (idempotent).

Base Command

claude-project-document-delete

Input

Argument Name	Description	Required
document_id	The Claude project document ID to permanently delete (e.g., claude_proj_doc_…). Applies to project plain-text documents (project_doc). This is an irreversible hard delete.	Required

Context Output

Path	Type	Description
AnthropicClaude.DeletedProjectDocument.id	String	The ID of the project document that was deleted.
AnthropicClaude.DeletedProjectDocument.type	String	The deletion confirmation type (claude_project_document_deleted).
AnthropicClaude.DeletedProjectDocument.Deleted	Boolean	The deletion result for the project document (true when deleted).

Command example

!claude-project-document-delete document_id=claude_proj_doc_011CbqYrHZoNLmjzW2AC53fK

Context Example

{
    "AnthropicClaude": {
        "DeletedProjectDocument": {
            "Deleted": true,
            "id": "claude_proj_doc_011CbqYrHZoNLmjzW2AC53fK",
            "type": "claude_project_document_deleted"
        }
    }
}

Human Readable Output

Project document deleted

id type Deleted

claude_proj_doc_011CbqYrHZoNLmjzW2AC53fK claude_project_document_deleted true

id	type	Deleted
claude_proj_doc_011CbqYrHZoNLmjzW2AC53fK	claude_project_document_deleted	true

<~PLATFORM>

License Requirements

The following configuration parameters require the Cortex XSIAM license:

Fetch events

</~PLATFORM>

Configuration parameters

url — Server URL (required)
apikey —
model-select — Model
model-freetext — Model (Optional - overrides selected choice)
max_tokens — Max tokens (required)
temperature — Temperature
top_p — Top P
compliance_apikey — Compliance Access Key
organization_uuid — Organization UUID
isFetchEvents — Fetch events
activity_types — Activity types
max_events_per_fetch — Maximum number of events per fetch
eventFetchInterval — Events Fetch Interval
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings

Commands (18)

claude-chat-file-delete
Permanently delete a Claude file (a conversation file or a project binary file) via the Compliance API. This is an irreversible hard delete, and it requires a Compliance Access Key with the delete:compliance_user_data scope. Deleting an already-deleted or unknown file ID succeeds (idempotent).
claude-check-email-body
Check email body for possible security issues. It is possible to keep asking questions on the provided info using 'claude-send-message'. Resets conversation context by default.
claude-check-email-header
Checking email header for possible security issues. It is possible to keep asking questions on the provided info using 'claude-send-message'. Resets conversation context by default.
claude-create-soc-email-template
Create an email template out of the conversation context to be sent from the SOC.
claude-get-events
Manually retrieve Activity Feed events from the Anthropic Compliance API for testing and troubleshooting. Use this command for development and debugging only, as it may produce duplicate events, exceed API rate limits, or disrupt the fetch mechanism.
claude-get-project-document
Retrieve a project document including its text content (Compliance API).
claude-list-chat-messages
List the messages of a chat (Compliance API).
claude-list-chats
List chats metadata (Compliance API).
claude-list-group-members
List the members of a group (Compliance API).
claude-list-groups
List groups, or retrieve a single group when group_id is provided (Compliance API).
claude-list-organization-users
List the users of an organization (Compliance API).
claude-list-organizations
List the organizations under the parent organization (Compliance API).
claude-list-project-attachments
List the attachments of a project (Compliance API).
claude-list-projects
List projects, or retrieve a single project when project_id is provided (Compliance API).
claude-list-role-permissions
List the permissions of a role (Compliance API).
claude-list-roles
List roles of an organization, or retrieve a single role when role_id is provided (Compliance API).
claude-project-document-delete
Permanently delete a Claude project document (a plain-text project_doc) via the Compliance API. This is an irreversible hard delete, and it requires a Compliance Access Key with the delete:compliance_user_data scope. Deleting an already-deleted or unknown document ID succeeds (idempotent).
claude-send-message
Send a plain message to the selected Claude model and receive the generated response.

Source

AnthropicClaude.py AnthropicClaude_test.py AnthropicClaude.yml AnthropicClaude_description.md command_examples.txt

Download History Raw

category: Messaging and Conferencing
provider: Anthropic
commonfields:
  id: Anthropic Claude
  version: -1
sectionorder:
- Connect
- Collect
configuration:
- defaultvalue: https://api.anthropic.com/
  display: Server URL
  name: url
  required: true
  section: Connect
  type: 0
- display: ''
  displaypassword: API Key
  hiddenusername: true
  name: apikey
  required: false
  section: Connect
  type: 9
  additionalinfo: Anthropic API Key used for the LLM commands (claude-send-message, claude-check-email-*, claude-create-soc-email-template). Generate one at https://console.anthropic.com/keys.
- additionalinfo: The model that will process the inputs and generate the response.
  defaultvalue: claude-3-haiku-20240307
  display: Model
  name: model-select
  options:
  - claude-3-haiku-20240307
  - claude-3-7-sonnet-20250219
  - claude-3-7-sonnet-latest
  - claude-3-5-haiku-latest
  - claude-sonnet-4-5
  - claude-sonnet-4-5-20250929
  - claude-opus-4-1
  - claude-opus-4-1-20250805
  - claude-opus-4-20250514
  - claude-sonnet-4-20250514
  - claude-haiku-4-5
  - claude-haiku-4-5-20251001
  required: false
  section: Connect
  type: 15
- additionalinfo: The model that will process the inputs and generate the response.
  display: Model (Optional - overrides selected choice)
  name: model-freetext
  required: false
  section: Connect
  type: 0
- additionalinfo: The maximum number of tokens that can be generated for the response. Required by Anthropic's API (defaults to 1024).
  defaultvalue: '1024'
  display: Max tokens
  name: max_tokens
  required: true
  section: Collect
  type: 0
- additionalinfo: Sets the randomness in responses. Lower values (closer to 0) produce more deterministic and consistent outputs, while higher values (up to 1) increase randomness and variety.
  advanced: true
  display: Temperature
  name: temperature
  required: false
  section: Collect
  type: 0
- additionalinfo: Enables nucleus sampling where only the top 'p' percent (0 to 1) of probable tokens are considered. Lower values result in more focused outputs, while higher values increase diversity.
  advanced: true
  display: Top P
  name: top_p
  required: false
  section: Collect
  type: 0
- display: Compliance Access Key
  name: compliance_apikey
  required: false
  type: 9
  section: Connect
  additionalinfo: The Anthropic Compliance Access Key (sk-ant-api01-...) used for event collection and the read-only compliance commands. Required to fetch events and to run the claude-list-* / claude-get-* commands.
  displaypassword: Compliance Access Key
  hiddenusername: true
- display: Organization UUID
  name: organization_uuid
  required: false
  type: 0
  section: Collect
  additionalinfo: The default Organization UUID to use for compliance commands that accept an org_uuid argument. The command argument overrides this value when provided.
- display: Fetch events
  name: isFetchEvents
  required: false
  type: 8
  section: Collect
  hidden:
  - xsoar
  supportedModules:
  - xsiam
- display: Activity types
  name: activity_types
  required: false
  section: Collect
  type: 0
  additionalinfo: 'A comma-separated list of Activity Feed types to narrow the feed (e.g., user.login,chat.created). Leave empty to fetch all activity types. See the available activity types here: https://platform.claude.com/docs/en/api/compliance/activities/list.'
  hidden:
  - xsoar
  supportedModules:
  - xsiam
- display: Maximum number of events per fetch
  name: max_events_per_fetch
  required: false
  section: Collect
  type: 0
  advanced: true
  defaultvalue: '50000'
  additionalinfo: The maximum number of events to fetch per cycle.
  hidden:
  - xsoar
  supportedModules:
  - xsiam
- defaultvalue: '1'
  display: Events Fetch Interval
  name: eventFetchInterval
  type: 19
  section: Collect
  advanced: true
  required: false
  hidden:
  - xsoar
  supportedModules:
  - xsiam
- display: Trust any certificate (not secure)
  name: insecure
  required: false
  type: 8
  section: Connect
- display: Use system proxy settings
  name: proxy
  required: false
  type: 8
  section: Connect
description: Designed to assist security professionals with security investigations, threat hunting, and anomaly detection, leveraging Anthropic Claude's natural language conversational capabilities.
display: Anthropic Claude
name: Anthropic Claude
script:
  commands:
  - arguments:
    - description: The message that the Claude model will respond to.
      name: message
      required: true
    - auto: PREDEFINED
      description: Whether to keep previously sent messages in a conversation context or start a new conversation.
      name: reset_conversation_history
      predefined:
      - yes
      - no
    - description: The maximum number of tokens that can be generated for the response.
      name: max_tokens
    - description: Sets the randomness in responses. Lower values (closer to 0) produce more deterministic and consistent outputs, while higher values (up to 1) increase randomness and variety.
      name: temperature
    - description: (0-1) Enables nucleus sampling where only the top 'p' percent of probable tokens are considered. Lower values result in more focused outputs, while higher values increase diversity.
      name: top_p
    description: Send a plain message to the selected Claude model and receive the generated response.
    name: claude-send-message
    outputs:
    - contextPath: AnthropicClaude.Conversation
      description: Entire conversation (if not reset) between the user and the Claude model.
      type: Dictionary
  - arguments:
    - description: Entry ID of an uploaded '.eml' file.
      name: entry_id
      required: true
    - description: Additional instructions or security issue to focus on.
      name: additional_instructions
    - description: The maximum number of tokens that can be generated for the response.
      name: max_tokens
    - description: Sets the randomness in responses. Lower values (closer to 0) produce more deterministic and consistent outputs, while higher values (up to 1) increase randomness and variety.
      name: temperature
    - description: Enables nucleus sampling where only the top 'p' percent of probable tokens are considered. Lower values result in more focused outputs, while higher values increase diversity.
      name: top_p
    description: Checking email header for possible security issues. It is possible to keep asking questions on the provided info using 'claude-send-message'. Resets conversation context by default.
    name: claude-check-email-header
    outputs:
    - contextPath: AnthropicClaude.Conversation
      description: Entire conversation (if not reset) between the user and the Claude model.
      type: Dictionary
  - arguments:
    - description: Entry ID of an uploaded '.eml' file.
      name: entry_id
      required: true
    - description: Additional instructions or security issue to focus on.
      name: additional_instructions
    - description: The maximum number of tokens that can be generated for the response.
      name: max_tokens
    - description: Sets the randomness in responses. Lower values (closer to 0) produce more deterministic and consistent outputs, while higher values (up to 1) increase randomness and variety.
      name: temperature
    - description: Enables nucleus sampling where only the top 'p' percent of probable tokens are considered. Lower values result in more focused outputs, while higher values increase diversity.
      name: top_p
    description: Check email body for possible security issues. It is possible to keep asking questions on the provided info using 'claude-send-message'. Resets conversation context by default.
    name: claude-check-email-body
    outputs:
    - contextPath: AnthropicClaude.Conversation
      description: Entire conversation (if not reset) between the user and the Claude model.
      type: Dictionary
  - arguments:
    - description: Additional instructions or security issue to focus on.
      name: additional_instructions
    - description: The maximum number of tokens that can be generated for the response.
      name: max_tokens
    - description: Sets the randomness in responses. Lower values (closer to 0) produce more deterministic and consistent outputs, while higher values (up to 1) increase randomness and variety.
      name: temperature
    - description: Enables nucleus sampling where only the top 'p' percent of probable tokens are considered. Lower values result in more focused outputs, while higher values increase diversity.
      name: top_p
    description: Create an email template out of the conversation context to be sent from the SOC.
    name: claude-create-soc-email-template
    outputs:
    - contextPath: AnthropicClaude.Conversation
      description: Entire conversation (if not reset) between the user and the Claude model.
      type: Dictionary
  - arguments:
    - defaultValue: '50'
      description: The maximum number of events to retrieve.
      name: limit
    - auto: PREDEFINED
      defaultValue: 'false'
      description: Whether to push the events to Cortex XSIAM.
      name: should_push_events
      predefined:
      - 'true'
      - 'false'
    - description: A comma-separated list of Activity Feed types to narrow the feed.
      isArray: true
      name: activity_types
    - description: The RFC 3339 lower bound (inclusive) on event creation time (e.g., '2025-06-07T08:09:10Z').
      name: start_time
    - description: The RFC 3339 upper bound (exclusive) on event creation time (e.g., '2025-06-07T09:09:10Z').
      name: end_time
    description: Manually retrieve Activity Feed events from the Anthropic Compliance API for testing and troubleshooting. Use this command for development and debugging only, as it may produce duplicate events, exceed API rate limits, or disrupt the fetch mechanism.
    name: claude-get-events
  - arguments:
    - defaultValue: '50'
      description: 'Client-side cap on the number of organizations returned. Maximum: 1000.'
      name: limit
    description: List the organizations under the parent organization (Compliance API).
    name: claude-list-organizations
    outputs:
    - contextPath: AnthropicClaude.Organization.uuid
      description: The organization UUID.
      type: String
    - contextPath: AnthropicClaude.Organization.name
      description: The organization name.
      type: String
    - contextPath: AnthropicClaude.Organization.created_at
      description: The organization creation time (e.g., '2020-01-01T00:11:22Z').
      type: Date
  - arguments:
    - description: Organization UUID. Overrides the instance Organization UUID parameter when provided.
      name: org_uuid
    - defaultValue: '50'
      description: 'Maximum number of users to return. Maximum: 1000.'
      name: limit
    - description: Page token from a previous response's next_page.
      name: next_token
    description: List the users of an organization (Compliance API).
    name: claude-list-organization-users
    outputs:
    - contextPath: AnthropicClaude.Organization.User.id
      description: The user ID.
      type: String
    - contextPath: AnthropicClaude.Organization.User.full_name
      description: The user full name.
      type: String
    - contextPath: AnthropicClaude.Organization.User.email
      description: The user email.
      type: String
    - contextPath: AnthropicClaude.Organization.User.organization_role
      description: The user's role in the organization.
      type: String
    - contextPath: AnthropicClaude.Organization.User.created_at
      description: The user creation time (e.g., '2020-01-01T00:11:22Z').
      type: Date
  - arguments:
    - description: Organization UUID. Overrides the instance Organization UUID parameter when provided.
      name: org_uuid
    - description: When provided, returns that single role instead of the list.
      name: role_id
    - defaultValue: '50'
      description: 'Maximum number of roles to return. Maximum: 1000.'
      name: limit
    - description: Page token (list mode only).
      name: next_token
    description: List roles of an organization, or retrieve a single role when role_id is provided (Compliance API).
    name: claude-list-roles
    outputs:
    - contextPath: AnthropicClaude.Organization.Role.id
      description: The role ID.
      type: String
    - contextPath: AnthropicClaude.Organization.Role.name
      description: The role name.
      type: String
    - contextPath: AnthropicClaude.Organization.Role.description
      description: The role description.
      type: String
    - contextPath: AnthropicClaude.Organization.Role.created_at
      description: The role creation time (e.g., '2020-01-01T00:11:22Z').
      type: Date
    - contextPath: AnthropicClaude.Organization.Role.updated_at
      description: The role update time (e.g., '2020-01-01T00:11:22Z').
      type: Date
  - arguments:
    - description: Organization UUID. Overrides the instance Organization UUID parameter when provided.
      name: org_uuid
    - description: Role ID.
      name: role_id
      required: true
    - defaultValue: '50'
      description: 'Maximum number of permissions to return. Maximum: 1000.'
      name: limit
    - description: Page token.
      name: next_token
    description: List the permissions of a role (Compliance API).
    name: claude-list-role-permissions
    outputs:
    - contextPath: AnthropicClaude.Organization.Role.Permission.resource_type
      description: The permission resource type.
      type: String
    - contextPath: AnthropicClaude.Organization.Role.Permission.resource_id
      description: The permission resource ID.
      type: String
    - contextPath: AnthropicClaude.Organization.Role.Permission.action
      description: The permission action.
      type: String
  - arguments:
    - description: When provided, returns that single group instead of the list.
      name: group_id
    - description: Page size (list mode only).
      name: limit
    - description: Page token (list mode only).
      name: next_token
    description: List groups, or retrieve a single group when group_id is provided (Compliance API).
    name: claude-list-groups
    outputs:
    - contextPath: AnthropicClaude.Group.id
      description: The group ID.
      type: String
    - contextPath: AnthropicClaude.Group.name
      description: The group name.
      type: String
    - contextPath: AnthropicClaude.Group.description
      description: The group description.
      type: String
    - contextPath: AnthropicClaude.Group.source_type
      description: The group source type (direct or scim).
      type: String
    - contextPath: AnthropicClaude.Group.roles
      description: Array of role IDs assigned to the group.
      type: Unknown
    - contextPath: AnthropicClaude.Group.created_at
      description: The group creation time (e.g., '2020-01-01T00:11:22Z').
      type: Date
    - contextPath: AnthropicClaude.Group.updated_at
      description: The group update time (e.g., '2020-01-01T00:11:22Z').
      type: Date
  - arguments:
    - description: Group ID.
      name: group_id
      required: true
    - defaultValue: '50'
      description: 'Maximum number of members to return. Maximum: 1000.'
      name: limit
    - description: Page token.
      name: next_token
    description: List the members of a group (Compliance API).
    name: claude-list-group-members
    outputs:
    - contextPath: AnthropicClaude.Group.Member.user_id
      description: The member user ID.
      type: String
    - contextPath: AnthropicClaude.Group.Member.email
      description: The member email.
      type: String
    - contextPath: AnthropicClaude.Group.Member.created_at
      description: The membership creation time (e.g., '2020-01-01T00:11:22Z').
      type: Date
    - contextPath: AnthropicClaude.Group.Member.updated_at
      description: The membership update time (e.g., '2020-01-01T00:11:22Z').
      type: Date
  - arguments:
    - description: A comma-separated list of up to 10 user IDs. Run claude-list-organization-users first to obtain them.
      isArray: true
      name: user_ids
      required: true
    - description: A comma-separated list of organization UUID(s) to filter by.
      isArray: true
      name: organization_ids
    - description: Filter by project ID(s).
      isArray: true
      name: project_ids
    - description: 'The RFC 3339 lower bound on creation time (example: 2025-06-07T08:09:10Z).'
      name: created_at_gte
    - description: RFC 3339 upper bound on creation time.
      name: created_at_lte
    - description: RFC 3339 lower bound on update time.
      name: updated_at_gte
    - description: RFC 3339 upper bound on update time.
      name: updated_at_lte
    - description: Page size.
      name: limit
    - description: Cursor - walk toward newer chats.
      name: after_id
    - description: Cursor - walk toward older chats.
      name: before_id
    description: List chats metadata (Compliance API).
    name: claude-list-chats
    outputs:
    - contextPath: AnthropicClaude.Chat.id
      description: The chat ID.
      type: String
    - contextPath: AnthropicClaude.Chat.name
      description: The chat name.
      type: String
    - contextPath: AnthropicClaude.Chat.created_at
      description: The chat creation time (e.g., '2020-01-01T00:11:22Z').
      type: Date
    - contextPath: AnthropicClaude.Chat.updated_at
      description: The chat update time (e.g., '2020-01-01T00:11:22Z').
      type: Date
    - contextPath: AnthropicClaude.Chat.model
      description: The model used in the chat.
      type: String
    - contextPath: AnthropicClaude.Chat.organization_uuid
      description: The organization UUID.
      type: String
    - contextPath: AnthropicClaude.Chat.project_id
      description: The project ID.
      type: String
  - arguments:
    - description: Chat ID.
      name: chat_id
      required: true
    - defaultValue: '50'
      description: 'Maximum number of messages to return. Maximum: 1000.'
      name: limit
    - description: Cursor.
      name: after_id
    - description: Cursor.
      name: before_id
    - auto: PREDEFINED
      description: Sort direction.
      name: order
      predefined:
      - asc
      - desc
    - description: 'The RFC 3339 lower bound on creation time (example: 2025-06-07T08:09:10Z).'
      name: created_at_gte
    - description: RFC 3339 upper bound on creation time.
      name: created_at_lte
    - description: RFC 3339 lower bound on update time.
      name: updated_at_gte
    - description: RFC 3339 upper bound on update time.
      name: updated_at_lte
    description: List the messages of a chat (Compliance API).
    name: claude-list-chat-messages
    outputs:
    - contextPath: AnthropicClaude.Chat.Message.id
      description: The message ID.
      type: String
    - contextPath: AnthropicClaude.Chat.Message.role
      description: The message role (user or assistant).
      type: String
    - contextPath: AnthropicClaude.Chat.Message.created_at
      description: The message creation time (e.g., '2020-01-01T00:11:22Z').
      type: Date
  - arguments:
    - description: When provided, returns that single project instead of the list.
      name: project_id
    - defaultValue: '50'
      description: 'Maximum number of projects to return. Maximum: 100.'
      name: limit
    - description: Page token (list mode only).
      name: next_token
    description: List projects, or retrieve a single project when project_id is provided (Compliance API).
    name: claude-list-projects
    outputs:
    - contextPath: AnthropicClaude.Project.id
      description: The project ID.
      type: String
    - contextPath: AnthropicClaude.Project.name
      description: The project name.
      type: String
    - contextPath: AnthropicClaude.Project.is_private
      description: Whether the project is private.
      type: Boolean
    - contextPath: AnthropicClaude.Project.organization_uuid
      description: The organization UUID.
      type: String
    - contextPath: AnthropicClaude.Project.created_at
      description: The project creation time (e.g., '2020-01-01T00:11:22Z').
      type: Date
    - contextPath: AnthropicClaude.Project.updated_at
      description: The project update time (e.g., '2020-01-01T00:11:22Z').
      type: Date
  - arguments:
    - description: Project ID.
      name: project_id
      required: true
    - description: Page token.
      name: next_token
    description: List the attachments of a project (Compliance API).
    name: claude-list-project-attachments
    outputs:
    - contextPath: AnthropicClaude.Project.Attachment.id
      description: The attachment ID.
      type: String
    - contextPath: AnthropicClaude.Project.Attachment.filename
      description: The attachment filename.
      type: String
    - contextPath: AnthropicClaude.Project.Attachment.mime_type
      description: The attachment MIME type.
      type: String
    - contextPath: AnthropicClaude.Project.Attachment.type
      description: The attachment type (project_file or project_doc).
      type: String
    - contextPath: AnthropicClaude.Project.Attachment.created_at
      description: The attachment creation time (e.g., '2020-01-01T00:11:22Z').
      type: Date
  - arguments:
    - description: Project ID.
      name: project_id
      required: true
    - description: Project document ID.
      name: document_id
      required: true
    description: Retrieve a project document including its text content (Compliance API).
    name: claude-get-project-document
    outputs:
    - contextPath: AnthropicClaude.ProjectDocument.id
      description: The document ID.
      type: String
    - contextPath: AnthropicClaude.ProjectDocument.filename
      description: The document filename.
      type: String
    - contextPath: AnthropicClaude.ProjectDocument.mime_type
      description: The document MIME type.
      type: String
    - contextPath: AnthropicClaude.ProjectDocument.created_at
      description: The document creation time (e.g., '2020-01-01T00:11:22Z').
      type: Date
    - contextPath: AnthropicClaude.ProjectDocument.content
      description: The document text content.
      type: String
  - arguments:
    - description: 'The Claude file ID to permanently delete (e.g., claude_file_...). Deletes a file uploaded in a conversation or a project binary file (project_file). This is an irreversible hard delete.'
      name: file_id
      required: true
    description: 'Permanently delete a Claude file (a conversation file or a project binary file) via the Compliance API. This is an irreversible hard delete, and it requires a Compliance Access Key with the delete:compliance_user_data scope. Deleting an already-deleted or unknown file ID succeeds (idempotent).'
    execution: true
    name: claude-chat-file-delete
    outputs:
    - contextPath: AnthropicClaude.DeletedFile.id
      description: The ID of the file that was deleted.
      type: String
    - contextPath: AnthropicClaude.DeletedFile.type
      description: The deletion confirmation type (claude_file_deleted).
      type: String
    - contextPath: AnthropicClaude.DeletedFile.Deleted
      description: The deletion result for the file (true when deleted).
      type: Boolean
  - arguments:
    - description: 'The Claude project document ID to permanently delete (e.g., claude_proj_doc_...). Applies to project plain-text documents (project_doc). This is an irreversible hard delete.'
      name: document_id
      required: true
    description: 'Permanently delete a Claude project document (a plain-text project_doc) via the Compliance API. This is an irreversible hard delete, and it requires a Compliance Access Key with the delete:compliance_user_data scope. Deleting an already-deleted or unknown document ID succeeds (idempotent).'
    execution: true
    name: claude-project-document-delete
    outputs:
    - contextPath: AnthropicClaude.DeletedProjectDocument.id
      description: The ID of the project document that was deleted.
      type: String
    - contextPath: AnthropicClaude.DeletedProjectDocument.type
      description: The deletion confirmation type (claude_project_document_deleted).
      type: String
    - contextPath: AnthropicClaude.DeletedProjectDocument.Deleted
      description: The deletion result for the project document (true when deleted).
      type: Boolean
  dockerimage: demisto/parse-emails:0.1.48.10569905
  runonce: false
  script: ''
  subtype: python3
  type: python
  isfetchevents: true
fromversion: 6.0.0
tests:
- No tests (auto formatted)
marketplaces:
- xsoar
- marketplacev2
- platform