Detects a surge in successful Claude chat snapshot creation events for the same user email within a rolling 24-hour window, using Anthropic audit logs. Chat snapshots export conversation content as shareable artifacts, so sustained high-volume creation can indicate staging of organizational chat data for exfiltration via Anthropic's web service or automated bulk exports of prompts and responses. The rule aggregates events by user.email with action claude_chat_snapshot_created and outcome success, filtering for related file-category activity, and triggers when event_count >= 10 within the window. It maps to MITRE ATT&CK Exfiltration over Web Service (T1567) under Exfiltration (TA0010). Alert suppression is applied by user.email for 24 hours to reduce noise, while investigation fields capture source_ip, user_agent, organization_id, and related chat identifiers to correlate with exports or shared links. False positives include legitimate bulk sharing, archival or training workflows. Triage steps include verifying the uniqueness of chats, inspecting IP/UA for automation, and correlating with exports or deletions across organizations. Remediation involves revoking sessions, auditing destinations and shared links, and tightening export or chat-sharing policies for the actor.