AnthropicClaudeStandardConnector

Details

ID	`AnthropicClaudeStandardConnector`
Provider	Anthropic
Category	Analytics & SIEM
From Version	8.15.0
Docker Image	`demisto/parse-emails:0.1.48.10569905`
Supported Modules	Agentix Cloud Runtime Security XSIAM EDR Cortex Cloud

README

This integration is configured automatically as part of the Anthropic Claude Standard Connector. Do not configure this integration directly — set it up from the connector page instead.

Configure Anthropic Claude (Standard Connector) in Cortex

Parameter	Description	Required
Compliance Access Key	The Anthropic Compliance Access Key (sk-ant-api01-…) used for the delete commands. Requires the delete:compliance_user_data scope.	False
Use system proxy settings	Route requests through the system HTTPS proxy configured on the server.	False
Trust any certificate (not secure)	Bypass TLS certificate validation. Not recommended for production use.	False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

claude-chat-file-delete

Permanently delete a Claude file (a conversation file or a project binary file) via the Compliance API. This is an irreversible hard delete, and it requires a Compliance Access Key with the delete:compliance_user_data scope. Deleting an already-deleted or unknown file ID succeeds (idempotent).

Base Command

claude-chat-file-delete

Input

Argument Name	Description	Required
file_id	The Claude file ID to permanently delete (e.g., claude_file_…). Deletes a file uploaded in a conversation or a project binary file (project_file). This is an irreversible hard delete.	Required

Context Output

Path	Type	Description
AnthropicClaude.DeletedFile.id	String	The ID of the file that was deleted.
AnthropicClaude.DeletedFile.type	String	The deletion confirmation type (claude_file_deleted).
AnthropicClaude.DeletedFile.Deleted	Boolean	The deletion result for the file (true when deleted).

Command example

!claude-chat-file-delete file_id=claude_file_011CbqYrHZoNLmjzW2AC53fK

Context Example

{
    "AnthropicClaude": {
        "DeletedFile": {
            "Deleted": true,
            "id": "claude_file_011CbqYrHZoNLmjzW2AC53fK",
            "type": "claude_file_deleted"
        }
    }
}

Human Readable Output

File deleted

id type Deleted

claude_file_011CbqYrHZoNLmjzW2AC53fK claude_file_deleted true

id	type	Deleted
claude_file_011CbqYrHZoNLmjzW2AC53fK	claude_file_deleted	true

claude-project-document-delete

Permanently delete a Claude project document (a plain-text project_doc) via the Compliance API. This is an irreversible hard delete, and it requires a Compliance Access Key with the delete:compliance_user_data scope. Deleting an already-deleted or unknown document ID succeeds (idempotent).

Base Command

claude-project-document-delete

Input

Argument Name	Description	Required
document_id	The Claude project document ID to permanently delete (e.g., claude_proj_doc_…). Applies to project plain-text documents (project_doc). This is an irreversible hard delete.	Required

Context Output

Path	Type	Description
AnthropicClaude.DeletedProjectDocument.id	String	The ID of the project document that was deleted.
AnthropicClaude.DeletedProjectDocument.type	String	The deletion confirmation type (claude_project_document_deleted).
AnthropicClaude.DeletedProjectDocument.Deleted	Boolean	The deletion result for the project document (true when deleted).

Command example

!claude-project-document-delete document_id=claude_proj_doc_011CbqYrHZoNLmjzW2AC53fK

Context Example

{
    "AnthropicClaude": {
        "DeletedProjectDocument": {
            "Deleted": true,
            "id": "claude_proj_doc_011CbqYrHZoNLmjzW2AC53fK",
            "type": "claude_project_document_deleted"
        }
    }
}

Human Readable Output

Project document deleted

id type Deleted

claude_proj_doc_011CbqYrHZoNLmjzW2AC53fK claude_project_document_deleted true

id	type	Deleted
claude_proj_doc_011CbqYrHZoNLmjzW2AC53fK	claude_project_document_deleted	true

Configuration parameters

compliance_apikey —
proxy — Use system proxy settings
insecure — Trust any certificate (not secure)

Commands (2)

claude-chat-file-delete
Permanently delete a Claude file (a conversation file or a project binary file) via the Compliance API. This is an irreversible hard delete, and it requires a Compliance Access Key with the delete:compliance_user_data scope. Deleting an already-deleted or unknown file ID succeeds (idempotent).
claude-project-document-delete
Permanently delete a Claude project document (a plain-text project_doc) via the Compliance API. This is an irreversible hard delete, and it requires a Compliance Access Key with the delete:compliance_user_data scope. Deleting an already-deleted or unknown document ID succeeds (idempotent).

Source

AnthropicClaudeStandardConnector.py AnthropicClaudeStandardConnector_test.py AnthropicClaudeStandardConnector.yml AnthropicClaudeStandardConnector_description.md command_examples.txt

Download History Raw

"""Sanity tests for the AnthropicClaudeStandardConnector shim integration.

Full behavioural coverage lives in the AnthropicClaudeApiModule tests; this file
exists only to confirm the shim wires through to the ApiModule correctly. The
satellite integration exposes only the two delete commands in its YAML, but the
shared ``run_anthropic_claude_integration()`` function still holds the full
dispatcher — the YAML is the enforcement boundary.
"""

import pytest

import AnthropicClaudeStandardConnector as integration_module


def test_shim_imports_run_entry_point():
    assert hasattr(
        integration_module, "run_anthropic_claude_integration"
    ), "AnthropicClaudeApiModule.run_anthropic_claude_integration must be importable via the shim"


def test_shim_imports_delete_commands():
    """The satellite integration YAML surfaces exactly these two delete commands."""
    assert hasattr(integration_module, "chat_file_delete_command")
    assert hasattr(integration_module, "project_document_delete_command")


def test_shim_imports_compliance_client():
    """The delete commands require the ComplianceClient (Compliance Access Key auth)."""
    assert hasattr(integration_module, "ComplianceClient")


def test_main_delegates_to_api_module(mocker):
    mock_run = mocker.patch("AnthropicClaudeStandardConnector.run_anthropic_claude_integration")
    integration_module.main()
    mock_run.assert_called_once_with()


def test_main_propagates_exceptions(mocker):
    mocker.patch(
        "AnthropicClaudeStandardConnector.run_anthropic_claude_integration",
        side_effect=RuntimeError("boom"),
    )
    with pytest.raises(RuntimeError, match="boom"):
        integration_module.main()