Free lab · no signup · about 10 minutes
AI Investigation Scoping Lab
Scoping an AI incident means answering two questions first: which Claude environment, and which starting point. Those two choices tell you which records exist, which event names to search and which controls to check.
Work through five short cases. Each is graded on environment, evidence, pivot order and controls, and every wrong answer explains itself.
Five short incidents, one for each starting point. For each: pick the Claude environment, the evidence sources worth pulling, the order of your pivots, and the controls to review. Some options are traps that sound right.
- 1. Account compromiseThe 02:14 magic link
- 2. Persistence & privilege escalationThe helpful docs-sync server
- 3. Defense evasionThe quiet night
- 4. Data exposureSomeone else’s claim
- 5. Agent abuseThe agent that emailed the forecast
Synthetic training data: every organisation, person, IP address (RFC 5737) and domain (.example) is invented.
The five starting points
Most investigations begin with one of these questions. Keep the event names handy: they are what you will search the Activity Feed and your telemetry for.
1. Account compromise · Did someone else get in, and what did they do next?
Enterprise: Sign-in events, then pivot on the same actor to chat, file and project activity.
Platform: Console sign-ins, API key creation, service account changes and file access by the same actor or credential.
Code & Cowork: Session metadata and transcripts, authentication telemetry, identity provider records.
sso_login_*social_login_succeededmagic_link_login_*
2. Persistence & privilege escalation · Did they leave themselves a way back in?
Enterprise: Invitations, role assignments, group membership and SCIM changes; new or changed organisation MCP servers; uploaded desktop extensions.
Platform: Changes to API and admin keys, service accounts, OAuth applications and workspace membership.
Code & Cowork: Settings and plugin changes, local MCP configuration and hooks.
mcp_server_createdmcp_server_updateddesktop_extension_uploaded
3. Defense evasion · Did they turn down what you can see or enforce?
Enterprise: Changes to the Compliance API, SSO, directory sync or inference hooks, and the IP restriction, tool policy, connector domain guard and Cowork setting events.
Platform: Compliance and workspace retention settings, credential and access control changes.
Code & Cowork: Cowork OTLP and Claude Code telemetry settings, managed settings, and permission mode and sandbox changes.
org_ip_restriction_*mcp_tool_policy_updatedorg_connector_domain_guard_updatedorg_cowork_*bypassPermissionsdangerouslyDisableSandboxpermission_mode_changed
4. Data exposure · What reached Claude or a connected system, and where could it go?
Enterprise: Chat, file and project content, export and sharing activity, and each connected service’s own record.
Platform: Application request and response logs, Files API objects, batch results and agent sessions.
Code & Cowork: Transcripts and content-enabled telemetry, checked against endpoint and destination records.
5. Agent abuse · What did the agent try, who started it, and what actually ran?
Enterprise: Remote Cowork sessions, including agent-owned runs and who started them; inference hook denials, fail-open events and circuit breaker trips.
Platform: Managed Agents configuration, sessions and activity; server tool use (web search, web fetch, code execution, MCP) from application logs.
Code & Cowork: Local sessions, tool decisions and where their approval came from, tool results, permission mode changes, endpoint and repository activity.
started_by_user
Four traps the lab tests
- The CSV audit export holds no chat or project content.
- The Compliance API does not return prompts and responses from your own API applications; your app logs do.
- Inference hook records never include Claude’s final response.
- Telemetry and the Activity Feed never backfill, and current settings may not be the settings in force during the incident.
Questions
How do you scope an investigation involving Claude?
Start from the environment under investigation (claude.ai, the Claude Platform API and Console, Claude Code or Cowork), because that decides which evidence exists. Then pick a starting point: account compromise, persistence and privilege escalation, defense evasion, data exposure or agent abuse. Each one points to specific records and event names, and to the controls you will review.
Which Activity Feed events matter for a compromised account?
Sign-in events such as sso_login_*, social_login_succeeded and magic_link_login_*. From the suspicious sign-in, pivot on the same actor to chat, file and project activity in Enterprise, or to API key creation, service account changes and file access on the Claude Platform.
Do inference hook records show what Claude answered?
No. A security server behind Enterprise inference hooks can keep the prompt payloads it checked and its own decisions, such as denials, but not Claude’s final response. Treat those records as supplementary and pair them with transcripts or content.
Can the Compliance API give me prompts from my own Claude API application?
No. Ordinary API prompts and responses are not available as conversation history through the Compliance API. Your application’s own request and response logs are the record, which is why they should carry the user, session or job identifier and the request id.
Keep going
- Evidence Expiry Race: now collect it before the clocks run out.
- AI Evidence Readiness Checker: which of these questions could your organisation answer today?
- Agent Trace Triage Lab: read the OTel spans behind an agent incident.
- Agent-IR Tabletop Lab: run the full response to a hijacked agent.
- Forensics Lab: endpoint and log forensics practice.
Further reading: Invictus Incident Response, “Frontier Forensics: Anthropic” (v1.0, October 2026, TLP:CLEAR), whose scoping decision tree and five starting points this lab is built around; their cheat sheet is on GitHub. Confirm current product behaviour in Anthropic’s documentation.
More security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.