← AI inventory

Claude

SIEM · Splunk (demo) Anthropic · Assistant · fixture host claude.ai

Policy · none set
Policy changes re-score this app on the next sync, which starts right away.
Finding · Open
Risk score
40
Medium
People
1
Usernames from the logs
Uploaded
7 MB
25 MB downloaded · 30 days
Events
320
1 source address
siemfixturecorroborated
Next steps

Recommended actions

  1. 01Claude trains on data unless a business tier or opt-out is used. Verify which tier these users are on.
  2. 02Splunk (demo) confirms what Microsoft 365 signals show for Claude. Use the source list here to find the exact devices and network segments involved.
Splunk (demo) · fixture

What the logs show

Hosts
HostEventsUploaded
claude.ai3207 MB
Top users
[email protected]320
Top sources
10.20.4.31320
Same app, other lanes

Related findings

Who

People

Identifiers come from device telemetry and proxy logs, so they may be account names rather than full directory entries.

PersonDepartmentSourceSign-ins · 30 dGranted
[email protected]
[email protected]
n/aSIEM logs0No direct grant
Why

Evidence

  1. siem_traffic · Sep 13, 2026
    Splunk (demo): 320 events to claude.ai from 1 user and 1 source in 30 days, 7 MB uploaded
    Detail
    {
  "hosts": [
    {
      "host": "claude.ai",
      "events": 320,
      "bytesOut": 7340032
    }
  ],
  "bytesIn": 26214400,
  "bytesOut": 7340032,
  "topUsers": [
    {
      "user": "[email protected]",
      "events": 320
    }
  ],
  "topSources": [
    {
      "events": 320,
      "source": "10.20.4.31"
    }
  ]
}
  2. corroboration
    Also found by another lane (mdca:34211)
    Detail
    {
  "findingKey": "mdca:34211"
}
  3. corroboration
    Also found by another lane (mail:anthropic-claude)
    Detail
    {
  "findingKey": "mail:anthropic-claude"
}
  4. corroboration
    Also found by another lane (dlp:anthropic-claude)
    Detail
    {
  "findingKey": "dlp:anthropic-claude"
}