This ES|QL rule detects the creation of a new Anthropic API key that has compliance read scopes, indicating potential unauthorized access to audit and compliance data. It monitors the Anthropic audit logs dataset (logs-anthropic.audit-*) for events where event.action equals api_key_created and event.outcome equals success, and where anthropic.audit.scopes includes read:compliance_activities or read:compliance_org_data. The match indicates a persistence-style action through credential manipulation, mapped to MITRE ATT&CK technique T1098.001 (Additional Cloud Credentials) under the Persistence tactic. The rule surfaces contextual fields such as anthropic.audit.api_key_id, scopes, actor type, and associated user information to enable attribution and pivoting on suspicious activity (e.g., unauthorized usage tracked as compliance_api_accessed). The rule assigns a high severity (high) and risk score (73) due to potential exposure of sensitive compliance data and chats, especially if the key is created by an unexpected actor. The detection is reinforced by a triage narrative that emphasizes validating the creator against an approved credentials inventory and correlating with related activity (admin role grants, log/event exports) during the exposure window. False positives include legitimate Fleet onboarding keys; these require inventory or ticket justification. Immediate remediation is to revoke unauthorized keys and review related compliance API/export activity during the exposure window, followed by credential inventory reconciliation and alert tuning.