Technical summary: The rule is an UEBA detection for Anthropic Claude usage. It ingests Anthropic Audit Logs (data_source: Application Log) and looks for a high number of successful Claude chat deletions by the same user email within a daily bucket. The query filters events where action = "claude_chat_deleted" and outcome = "success" with a non-null user.email, buckets by calendar day (DATE_TRUNC(1 day, @timestamp)), and aggregates fields such as event IDs, chat/project IDs, source IP, user agent, actor type, and user IDs. If a single user crosses the threshold of 30 deletions in a day, an alert is generated. The rule runs with a lookback window of now-24h and uses 1-hour aggregation intervals, with alert grouping by user.email and the time bucket to suppress duplicates for 24 hours. It maps to MITRE ATT&CK T1070 (Indicator Removal) under the Defense Evasion tactic (TA0005) and assigns a risk_score of 47 with severity set to medium. The investigation fields extract context like chat IDs, project IDs, and timestamps to facilitate root-cause analysis. The rule includes structured TRIAGE guidance: verify if deletions followed uploads/exports or logging changes, preserve audit exports, and correlate with possible scripted patterns. False positives include routine cleanup or migration tooling (scheduled retention, GDPR purges). Remediation emphasizes confirming whether sensitive content was uploaded/shared before deletion, revoking sessions, and ensuring compliance logging is intact. References point to Anthropic API compliance activity documentation. Overall, this rule aims to detect potential defense evasion through mass deletion of chat history and to guide responders through rapid triage and containment steps.