Detects an unusually high number of Claude chat creation events (event.action == "claude_chat_created" with outcome == "success") for the same user email within a 24-hour window. Implemented in ES|QL against Anthropic audit logs, it aggregates by user.email and flags when the count reaches or exceeds 20 events in the 24h window. The rule collects related fields (event IDs, Claude chat IDs, project IDs, source IPs, and user agents) to aid investigation and triage. This pattern can indicate automated abuse, quota exhaustion, or scripted parallel workflows used for data processing or prompt-injection campaigns. False positives include legitimate high-velocity testing or onboarding templates from admin activity. The rule supports targeted investigation steps such as prioritizing scripting UAs, correlating with large file uploads or exports, and reviewing project membership. It maps to MITRE ATT&CK techniques under Resource Hijacking (T1496) in the Impact tactic (TA0040). Alert suppression groups by user.email for 24 hours to reduce duplication. Investigation fields are provided to streamline triage, including timestamps, IDs, IPs, and user agents. References include the Anthropic API compliance activities endpoint.