Detects an unusually high volume of Claude file uploads from the same user email and source IP within a rolling 24-hour period. Sustained upload activity can indicate staging of sensitive documents in Claude chats for later retrieval, automated ingestion of data into LLM workflows, or abuse of organizational Claude access to move files into the cloud service. The detection uses Anthropic Audit Logs (logs-anthropic.audit-*), focusing on claude_file_uploaded events with outcome 'success' and non-null user.email and source.ip. The Esql query aggregates by user.email and source.ip over a 24h window (now-24h) and triggers when Esql.event_count >= 100, returning context such as file IDs, chat and project IDs, and the user agent to support triage. The rule maps to MITRE ATT&CK Exfiltration (TA0010) with technique T1567 Exfiltration Over Web Service. Alert suppression groups by user.email and source.ip for 24 hours to prevent alert storms. Investigation fields include key fields like event counts, file names, claude_file_id, chat_id, project_id, user_agent, and timestamps. False positives include bulk migrations or RAG pilots. Remediation guidance: revoke sessions for unauthorized staging, review filenames/file IDs for sensitive content, and tighten project sharing or upload policy. Risk score: 47 (medium); severity: medium.