Detects when an Anthropic service key is revoked. Revocation events can indicate an attacker disrupting integrations, invalidating a compromised key, or erasing activity traces. The rule identifies the affected key via service_key_id and the associated service via service_name. Runbook guidance helps distinguish key rotation from standalone revocations and evaluates the actor's IP against known VPNs/proxies or prior activity to assess risk.