This rule detects successful Anthropic audit events where the user agent indicates scripted HTTP clients or automation libraries (e.g., curl, python-requests, Go-http-client, axios, nuclei). Since browser or first-party Claude clients typically generate normal, recognizable user agents, this detection flags scripted or automated access patterns that may signal stolen sessions, credential abuse, or unauthorized automation. The rule relies on data from theAnthropic audit logs (anthropic.audit dataset) and requires non-null source IP and user email, with user_agent.original normalized to lowercase for pattern matching. It matches a comprehensive set of UA patterns (curl, python, wget, go-http, axios, node-fetch, httpie, many SDKs and penetration/testing tools, as well as common security tooling like nmap, nuclei, masscan, dirbuster, gobuster, hydra, metasploit, etc.). Benign automation patterns (e.g., axios or Go HTTP clients used for file uploads/deletes, trusted device enrollment, or environment creation) are explicitly excluded via exception logic for specific actions. The detection is implemented as an ES|QL query over logs-anthropic.audit and retains key fields for investigation. It includes suppression logic grouped by user, IP, and UA to reduce noise for short windows, and signals a medium-severity alert with a risk score of 47. The associated investigation fields emphasize actor identity, IP, and event details to facilitate rapid triage. The rule maps to MITRE ATT&CK technique T1071.001 (Web Protocols) under Command and Control. Remediation steps include revoking sessions, rotating credentials/MFA, reviewing admin/export activity, and expanding hunting across the same actor. Possible false positives include internal SDKs and CI jobs; adjustments to allowlists should be considered over wholesale suppression of whole UA families.