category: Messaging and Conferencing
provider: Anthropic
commonfields:
  id: Anthropic Claude
  version: -1
sectionorder:
- Connect
- Collect
configuration:
- defaultvalue: https://api.anthropic.com/
  display: Server URL
  name: url
  required: true
  section: Connect
  type: 0
- display: ''
  displaypassword: API Key
  hiddenusername: true
  name: apikey
  required: false
  section: Connect
  type: 9
  additionalinfo: Anthropic API Key used for the LLM commands (claude-send-message, claude-check-email-*, claude-create-soc-email-template). Generate one at https://console.anthropic.com/keys.
- additionalinfo: The model that will process the inputs and generate the response.
  defaultvalue: claude-3-haiku-20240307
  display: Model
  name: model-select
  options:
  - claude-3-haiku-20240307
  - claude-3-7-sonnet-20250219
  - claude-3-7-sonnet-latest
  - claude-3-5-haiku-latest
  - claude-sonnet-4-5
  - claude-sonnet-4-5-20250929
  - claude-opus-4-1
  - claude-opus-4-1-20250805
  - claude-opus-4-20250514
  - claude-sonnet-4-20250514
  - claude-haiku-4-5
  - claude-haiku-4-5-20251001
  required: false
  section: Connect
  type: 15
- additionalinfo: The model that will process the inputs and generate the response.
  display: Model (Optional - overrides selected choice)
  name: model-freetext
  required: false
  section: Connect
  type: 0
- additionalinfo: The maximum number of tokens that can be generated for the response. Required by Anthropic's API (defaults to 1024).
  defaultvalue: '1024'
  display: Max tokens
  name: max_tokens
  required: true
  section: Collect
  type: 0
- additionalinfo: Sets the randomness in responses. Lower values (closer to 0) produce more deterministic and consistent outputs, while higher values (up to 1) increase randomness and variety.
  advanced: true
  display: Temperature
  name: temperature
  required: false
  section: Collect
  type: 0
- additionalinfo: Enables nucleus sampling where only the top 'p' percent (0 to 1) of probable tokens are considered. Lower values result in more focused outputs, while higher values increase diversity.
  advanced: true
  display: Top P
  name: top_p
  required: false
  section: Collect
  type: 0
- display: Compliance Access Key
  name: compliance_apikey
  required: false
  type: 9
  section: Connect
  additionalinfo: The Anthropic Compliance Access Key (sk-ant-api01-...) used for event collection and the read-only compliance commands. Required to fetch events and to run the claude-list-* / claude-get-* commands.
  displaypassword: Compliance Access Key
  hiddenusername: true
- display: Organization UUID
  name: organization_uuid
  required: false
  type: 0
  section: Collect
  additionalinfo: The default Organization UUID to use for compliance commands that accept an org_uuid argument. The command argument overrides this value when provided.
- display: Fetch events
  name: isFetchEvents
  required: false
  type: 8
  section: Collect
  hidden:
  - xsoar
  supportedModules:
  - xsiam
- display: Activity types
  name: activity_types
  required: false
  section: Collect
  type: 0
  additionalinfo: 'A comma-separated list of Activity Feed types to narrow the feed (e.g., user.login,chat.created). Leave empty to fetch all activity types. See the available activity types here: https://platform.claude.com/docs/en/api/compliance/activities/list.'
  hidden:
  - xsoar
  supportedModules:
  - xsiam
- display: Maximum number of events per fetch
  name: max_events_per_fetch
  required: false
  section: Collect
  type: 0
  advanced: true
  defaultvalue: '50000'
  additionalinfo: The maximum number of events to fetch per cycle.
  hidden:
  - xsoar
  supportedModules:
  - xsiam
- defaultvalue: '1'
  display: Events Fetch Interval
  name: eventFetchInterval
  type: 19
  section: Collect
  advanced: true
  required: false
  hidden:
  - xsoar
  supportedModules:
  - xsiam
- display: Trust any certificate (not secure)
  name: insecure
  required: false
  type: 8
  section: Connect
- display: Use system proxy settings
  name: proxy
  required: false
  type: 8
  section: Connect
description: Designed to assist security professionals with security investigations, threat hunting, and anomaly detection, leveraging Anthropic Claude's natural language conversational capabilities.
display: Anthropic Claude
name: Anthropic Claude
script:
  commands:
  - arguments:
    - description: The message that the Claude model will respond to.
      name: message
      required: true
    - auto: PREDEFINED
      description: Whether to keep previously sent messages in a conversation context or start a new conversation.
      name: reset_conversation_history
      predefined:
      - yes
      - no
    - description: The maximum number of tokens that can be generated for the response.
      name: max_tokens
    - description: Sets the randomness in responses. Lower values (closer to 0) produce more deterministic and consistent outputs, while higher values (up to 1) increase randomness and variety.
      name: temperature
    - description: (0-1) Enables nucleus sampling where only the top 'p' percent of probable tokens are considered. Lower values result in more focused outputs, while higher values increase diversity.
      name: top_p
    description: Send a plain message to the selected Claude model and receive the generated response.
    name: claude-send-message
    outputs:
    - contextPath: AnthropicClaude.Conversation
      description: Entire conversation (if not reset) between the user and the Claude model.
      type: Dictionary
  - arguments:
    - description: Entry ID of an uploaded '.eml' file.
      name: entry_id
      required: true
    - description: Additional instructions or security issue to focus on.
      name: additional_instructions
    - description: The maximum number of tokens that can be generated for the response.
      name: max_tokens
    - description: Sets the randomness in responses. Lower values (closer to 0) produce more deterministic and consistent outputs, while higher values (up to 1) increase randomness and variety.
      name: temperature
    - description: Enables nucleus sampling where only the top 'p' percent of probable tokens are considered. Lower values result in more focused outputs, while higher values increase diversity.
      name: top_p
    description: Checking email header for possible security issues. It is possible to keep asking questions on the provided info using 'claude-send-message'. Resets conversation context by default.
    name: claude-check-email-header
    outputs:
    - contextPath: AnthropicClaude.Conversation
      description: Entire conversation (if not reset) between the user and the Claude model.
      type: Dictionary
  - arguments:
    - description: Entry ID of an uploaded '.eml' file.
      name: entry_id
      required: true
    - description: Additional instructions or security issue to focus on.
      name: additional_instructions
    - description: The maximum number of tokens that can be generated for the response.
      name: max_tokens
    - description: Sets the randomness in responses. Lower values (closer to 0) produce more deterministic and consistent outputs, while higher values (up to 1) increase randomness and variety.
      name: temperature
    - description: Enables nucleus sampling where only the top 'p' percent of probable tokens are considered. Lower values result in more focused outputs, while higher values increase diversity.
      name: top_p
    description: Check email body for possible security issues. It is possible to keep asking questions on the provided info using 'claude-send-message'. Resets conversation context by default.
    name: claude-check-email-body
    outputs:
    - contextPath: AnthropicClaude.Conversation
      description: Entire conversation (if not reset) between the user and the Claude model.
      type: Dictionary
  - arguments:
    - description: Additional instructions or security issue to focus on.
      name: additional_instructions
    - description: The maximum number of tokens that can be generated for the response.
      name: max_tokens
    - description: Sets the randomness in responses. Lower values (closer to 0) produce more deterministic and consistent outputs, while higher values (up to 1) increase randomness and variety.
      name: temperature
    - description: Enables nucleus sampling where only the top 'p' percent of probable tokens are considered. Lower values result in more focused outputs, while higher values increase diversity.
      name: top_p
    description: Create an email template out of the conversation context to be sent from the SOC.
    name: claude-create-soc-email-template
    outputs:
    - contextPath: AnthropicClaude.Conversation
      description: Entire conversation (if not reset) between the user and the Claude model.
      type: Dictionary
  - arguments:
    - defaultValue: '50'
      description: The maximum number of events to retrieve.
      name: limit
    - auto: PREDEFINED
      defaultValue: 'false'
      description: Whether to push the events to Cortex XSIAM.
      name: should_push_events
      predefined:
      - 'true'
      - 'false'
    - description: A comma-separated list of Activity Feed types to narrow the feed.
      isArray: true
      name: activity_types
    - description: The RFC 3339 lower bound (inclusive) on event creation time (e.g., '2025-06-07T08:09:10Z').
      name: start_time
    - description: The RFC 3339 upper bound (exclusive) on event creation time (e.g., '2025-06-07T09:09:10Z').
      name: end_time
    description: Manually retrieve Activity Feed events from the Anthropic Compliance API for testing and troubleshooting. Use this command for development and debugging only, as it may produce duplicate events, exceed API rate limits, or disrupt the fetch mechanism.
    name: claude-get-events
  - arguments:
    - defaultValue: '50'
      description: 'Client-side cap on the number of organizations returned. Maximum: 1000.'
      name: limit
    description: List the organizations under the parent organization (Compliance API).
    name: claude-list-organizations
    outputs:
    - contextPath: AnthropicClaude.Organization.uuid
      description: The organization UUID.
      type: String
    - contextPath: AnthropicClaude.Organization.name
      description: The organization name.
      type: String
    - contextPath: AnthropicClaude.Organization.created_at
      description: The organization creation time (e.g., '2020-01-01T00:11:22Z').
      type: Date
  - arguments:
    - description: Organization UUID. Overrides the instance Organization UUID parameter when provided.
      name: org_uuid
    - defaultValue: '50'
      description: 'Maximum number of users to return. Maximum: 1000.'
      name: limit
    - description: Page token from a previous response's next_page.
      name: next_token
    description: List the users of an organization (Compliance API).
    name: claude-list-organization-users
    outputs:
    - contextPath: AnthropicClaude.Organization.User.id
      description: The user ID.
      type: String
    - contextPath: AnthropicClaude.Organization.User.full_name
      description: The user full name.
      type: String
    - contextPath: AnthropicClaude.Organization.User.email
      description: The user email.
      type: String
    - contextPath: AnthropicClaude.Organization.User.organization_role
      description: The user's role in the organization.
      type: String
    - contextPath: AnthropicClaude.Organization.User.created_at
      description: The user creation time (e.g., '2020-01-01T00:11:22Z').
      type: Date
  - arguments:
    - description: Organization UUID. Overrides the instance Organization UUID parameter when provided.
      name: org_uuid
    - description: When provided, returns that single role instead of the list.
      name: role_id
    - defaultValue: '50'
      description: 'Maximum number of roles to return. Maximum: 1000.'
      name: limit
    - description: Page token (list mode only).
      name: next_token
    description: List roles of an organization, or retrieve a single role when role_id is provided (Compliance API).
    name: claude-list-roles
    outputs:
    - contextPath: AnthropicClaude.Organization.Role.id
      description: The role ID.
      type: String
    - contextPath: AnthropicClaude.Organization.Role.name
      description: The role name.
      type: String
    - contextPath: AnthropicClaude.Organization.Role.description
      description: The role description.
      type: String
    - contextPath: AnthropicClaude.Organization.Role.created_at
      description: The role creation time (e.g., '2020-01-01T00:11:22Z').
      type: Date
    - contextPath: AnthropicClaude.Organization.Role.updated_at
      description: The role update time (e.g., '2020-01-01T00:11:22Z').
      type: Date
  - arguments:
    - description: Organization UUID. Overrides the instance Organization UUID parameter when provided.
      name: org_uuid
    - description: Role ID.
      name: role_id
      required: true
    - defaultValue: '50'
      description: 'Maximum number of permissions to return. Maximum: 1000.'
      name: limit
    - description: Page token.
      name: next_token
    description: List the permissions of a role (Compliance API).
    name: claude-list-role-permissions
    outputs:
    - contextPath: AnthropicClaude.Organization.Role.Permission.resource_type
      description: The permission resource type.
      type: String
    - contextPath: AnthropicClaude.Organization.Role.Permission.resource_id
      description: The permission resource ID.
      type: String
    - contextPath: AnthropicClaude.Organization.Role.Permission.action
      description: The permission action.
      type: String
  - arguments:
    - description: When provided, returns that single group instead of the list.
      name: group_id
    - description: Page size (list mode only).
      name: limit
    - description: Page token (list mode only).
      name: next_token
    description: List groups, or retrieve a single group when group_id is provided (Compliance API).
    name: claude-list-groups
    outputs:
    - contextPath: AnthropicClaude.Group.id
      description: The group ID.
      type: String
    - contextPath: AnthropicClaude.Group.name
      description: The group name.
      type: String
    - contextPath: AnthropicClaude.Group.description
      description: The group description.
      type: String
    - contextPath: AnthropicClaude.Group.source_type
      description: The group source type (direct or scim).
      type: String
    - contextPath: AnthropicClaude.Group.roles
      description: Array of role IDs assigned to the group.
      type: Unknown
    - contextPath: AnthropicClaude.Group.created_at
      description: The group creation time (e.g., '2020-01-01T00:11:22Z').
      type: Date
    - contextPath: AnthropicClaude.Group.updated_at
      description: The group update time (e.g., '2020-01-01T00:11:22Z').
      type: Date
  - arguments:
    - description: Group ID.
      name: group_id
      required: true
    - defaultValue: '50'
      description: 'Maximum number of members to return. Maximum: 1000.'
      name: limit
    - description: Page token.
      name: next_token
    description: List the members of a group (Compliance API).
    name: claude-list-group-members
    outputs:
    - contextPath: AnthropicClaude.Group.Member.user_id
      description: The member user ID.
      type: String
    - contextPath: AnthropicClaude.Group.Member.email
      description: The member email.
      type: String
    - contextPath: AnthropicClaude.Group.Member.created_at
      description: The membership creation time (e.g., '2020-01-01T00:11:22Z').
      type: Date
    - contextPath: AnthropicClaude.Group.Member.updated_at
      description: The membership update time (e.g., '2020-01-01T00:11:22Z').
      type: Date
  - arguments:
    - description: A comma-separated list of up to 10 user IDs. Run claude-list-organization-users first to obtain them.
      isArray: true
      name: user_ids
      required: true
    - description: A comma-separated list of organization UUID(s) to filter by.
      isArray: true
      name: organization_ids
    - description: Filter by project ID(s).
      isArray: true
      name: project_ids
    - description: 'The RFC 3339 lower bound on creation time (example: 2025-06-07T08:09:10Z).'
      name: created_at_gte
    - description: RFC 3339 upper bound on creation time.
      name: created_at_lte
    - description: RFC 3339 lower bound on update time.
      name: updated_at_gte
    - description: RFC 3339 upper bound on update time.
      name: updated_at_lte
    - description: Page size.
      name: limit
    - description: Cursor - walk toward newer chats.
      name: after_id
    - description: Cursor - walk toward older chats.
      name: before_id
    description: List chats metadata (Compliance API).
    name: claude-list-chats
    outputs:
    - contextPath: AnthropicClaude.Chat.id
      description: The chat ID.
      type: String
    - contextPath: AnthropicClaude.Chat.name
      description: The chat name.
      type: String
    - contextPath: AnthropicClaude.Chat.created_at
      description: The chat creation time (e.g., '2020-01-01T00:11:22Z').
      type: Date
    - contextPath: AnthropicClaude.Chat.updated_at
      description: The chat update time (e.g., '2020-01-01T00:11:22Z').
      type: Date
    - contextPath: AnthropicClaude.Chat.model
      description: The model used in the chat.
      type: String
    - contextPath: AnthropicClaude.Chat.organization_uuid
      description: The organization UUID.
      type: String
    - contextPath: AnthropicClaude.Chat.project_id
      description: The project ID.
      type: String
  - arguments:
    - description: Chat ID.
      name: chat_id
      required: true
    - defaultValue: '50'
      description: 'Maximum number of messages to return. Maximum: 1000.'
      name: limit
    - description: Cursor.
      name: after_id
    - description: Cursor.
      name: before_id
    - auto: PREDEFINED
      description: Sort direction.
      name: order
      predefined:
      - asc
      - desc
    - description: 'The RFC 3339 lower bound on creation time (example: 2025-06-07T08:09:10Z).'
      name: created_at_gte
    - description: RFC 3339 upper bound on creation time.
      name: created_at_lte
    - description: RFC 3339 lower bound on update time.
      name: updated_at_gte
    - description: RFC 3339 upper bound on update time.
      name: updated_at_lte
    description: List the messages of a chat (Compliance API).
    name: claude-list-chat-messages
    outputs:
    - contextPath: AnthropicClaude.Chat.Message.id
      description: The message ID.
      type: String
    - contextPath: AnthropicClaude.Chat.Message.role
      description: The message role (user or assistant).
      type: String
    - contextPath: AnthropicClaude.Chat.Message.created_at
      description: The message creation time (e.g., '2020-01-01T00:11:22Z').
      type: Date
  - arguments:
    - description: When provided, returns that single project instead of the list.
      name: project_id
    - defaultValue: '50'
      description: 'Maximum number of projects to return. Maximum: 100.'
      name: limit
    - description: Page token (list mode only).
      name: next_token
    description: List projects, or retrieve a single project when project_id is provided (Compliance API).
    name: claude-list-projects
    outputs:
    - contextPath: AnthropicClaude.Project.id
      description: The project ID.
      type: String
    - contextPath: AnthropicClaude.Project.name
      description: The project name.
      type: String
    - contextPath: AnthropicClaude.Project.is_private
      description: Whether the project is private.
      type: Boolean
    - contextPath: AnthropicClaude.Project.organization_uuid
      description: The organization UUID.
      type: String
    - contextPath: AnthropicClaude.Project.created_at
      description: The project creation time (e.g., '2020-01-01T00:11:22Z').
      type: Date
    - contextPath: AnthropicClaude.Project.updated_at
      description: The project update time (e.g., '2020-01-01T00:11:22Z').
      type: Date
  - arguments:
    - description: Project ID.
      name: project_id
      required: true
    - description: Page token.
      name: next_token
    description: List the attachments of a project (Compliance API).
    name: claude-list-project-attachments
    outputs:
    - contextPath: AnthropicClaude.Project.Attachment.id
      description: The attachment ID.
      type: String
    - contextPath: AnthropicClaude.Project.Attachment.filename
      description: The attachment filename.
      type: String
    - contextPath: AnthropicClaude.Project.Attachment.mime_type
      description: The attachment MIME type.
      type: String
    - contextPath: AnthropicClaude.Project.Attachment.type
      description: The attachment type (project_file or project_doc).
      type: String
    - contextPath: AnthropicClaude.Project.Attachment.created_at
      description: The attachment creation time (e.g., '2020-01-01T00:11:22Z').
      type: Date
  - arguments:
    - description: Project ID.
      name: project_id
      required: true
    - description: Project document ID.
      name: document_id
      required: true
    description: Retrieve a project document including its text content (Compliance API).
    name: claude-get-project-document
    outputs:
    - contextPath: AnthropicClaude.ProjectDocument.id
      description: The document ID.
      type: String
    - contextPath: AnthropicClaude.ProjectDocument.filename
      description: The document filename.
      type: String
    - contextPath: AnthropicClaude.ProjectDocument.mime_type
      description: The document MIME type.
      type: String
    - contextPath: AnthropicClaude.ProjectDocument.created_at
      description: The document creation time (e.g., '2020-01-01T00:11:22Z').
      type: Date
    - contextPath: AnthropicClaude.ProjectDocument.content
      description: The document text content.
      type: String
  - arguments:
    - description: 'The Claude file ID to permanently delete (e.g., claude_file_...). Deletes a file uploaded in a conversation or a project binary file (project_file). This is an irreversible hard delete.'
      name: file_id
      required: true
    description: 'Permanently delete a Claude file (a conversation file or a project binary file) via the Compliance API. This is an irreversible hard delete, and it requires a Compliance Access Key with the delete:compliance_user_data scope. Deleting an already-deleted or unknown file ID succeeds (idempotent).'
    execution: true
    name: claude-chat-file-delete
    outputs:
    - contextPath: AnthropicClaude.DeletedFile.id
      description: The ID of the file that was deleted.
      type: String
    - contextPath: AnthropicClaude.DeletedFile.type
      description: The deletion confirmation type (claude_file_deleted).
      type: String
    - contextPath: AnthropicClaude.DeletedFile.Deleted
      description: The deletion result for the file (true when deleted).
      type: Boolean
  - arguments:
    - description: 'The Claude project document ID to permanently delete (e.g., claude_proj_doc_...). Applies to project plain-text documents (project_doc). This is an irreversible hard delete.'
      name: document_id
      required: true
    description: 'Permanently delete a Claude project document (a plain-text project_doc) via the Compliance API. This is an irreversible hard delete, and it requires a Compliance Access Key with the delete:compliance_user_data scope. Deleting an already-deleted or unknown document ID succeeds (idempotent).'
    execution: true
    name: claude-project-document-delete
    outputs:
    - contextPath: AnthropicClaude.DeletedProjectDocument.id
      description: The ID of the project document that was deleted.
      type: String
    - contextPath: AnthropicClaude.DeletedProjectDocument.type
      description: The deletion confirmation type (claude_project_document_deleted).
      type: String
    - contextPath: AnthropicClaude.DeletedProjectDocument.Deleted
      description: The deletion result for the project document (true when deleted).
      type: Boolean
  dockerimage: demisto/parse-emails:0.1.48.10569905
  runonce: false
  script: ''
  subtype: python3
  type: python
  isfetchevents: true
fromversion: 6.0.0
tests:
- No tests (auto formatted)
marketplaces:
- xsoar
- marketplacev2
- platform