This rule detects potential automated enumeration of Anthropic Claude chats by a single authenticated user within an organization. It analyzes Anthropic audit logs for claude_chat_access_failed events and aggregates them by user.id, organization.id, and source.ip over a 24-hour window. When the count of failed access attempts for a given user within that org/IP exceeds a threshold of 20, an alert is generated. The rule explicitly excludes unauthenticated access attempts from shared links (no user.id). Investigative data surfaced includes claude_chat_id and claude_project_id (to identify which chats were targeted), user_agent (to detect automation), and timestamps (first/last seen) to support sequencing. Alert suppression groups on user.id, organization.id, and source.ip for 24 hours to prevent alert storms. The detection leverages ES|QL against the Anthropic audit dataset and maps to MITRE ATT&CK Discovery, specifically T1526 Cloud Service Discovery, reflecting attempts to enumerate cloud-hosted chat resources. References include the Anthropic API compliance activities list. Typical true positives show a high failure-to-success ratio with patterned or sequential chat IDs and potential automation user agents; false positives include legitimate investigation or incident response where many revoked or stale links are reviewed. Investigators should start from the alert keys and correlate the events with claude_chat_viewed activity, IAM/SSO changes, and any subsequent successful views. If enumeration is confirmed, recommended responses include revoking sessions, reviewing recently accessed chats, rotating exposed shared links, and auditing for data export or sharing by the same actor.