This rule detects deletion of admin API keys for Anthropic by monitoring Anthropic Audit Logs. It identifies events where an admin API key is deleted (event.action == "admin_api_key_deleted") within the Anthropic IAM context (event.category contains "iam"), scoped to the anthropic.audit data stream. The detection uses a ES|QL query to extract: _id, _version, _index, @timestamp, event.*, organization.*, user.*, source.*, user_agent.*, anthropic.audit.*, data_stream.*. The goal is to catch unauthorized deletions that occur without a nearby rotation (admin_api_key_created) or a decommission/change ticket, which could indicate sabotage or credential compromise. The rule maps to MITRE ATT&CK technique T1531 (Account Access Removal) under Impact (TA0040). Investigation guidance emphasizes noting the deleted anthropic.audit.admin_api_key_id and actor, distinguishing rotation (create+delete in a window by same actor) from standalone deletion, and correlating with ingestion changes, exports, or SSO modifications. False positives include legitimate scheduled rotations that pair delete with create events. Remediation focuses on restoring necessary integrations with new keys, validating audit ingestion, and reviewing other admin changes by the same actor within the exposure window. References and an explicit risk score (47, severity: medium) support prioritization and triage workflows.