cyber.hendryadrian.com
Detection & Defense · trendmicro.com

Trend Micro’s Collector Scans Claude Enterprise Chats for Policy Violations

· Original article ↗

Summary

Trend Micro’s Claude Compliance Collector retrieves Claude Enterprise conversations through Anthropic’s Compliance API, scans them with AI Guard for policy violations, and sends detections to the AI Application Security dashboard.

Key points

  • The collector retrieves conversation data from Anthropic’s Compliance API on a configurable schedule, every four hours by default.
  • It discovers active chat IDs in a configured time window, excludes deleted chats, and retrieves prompts, model responses, and text sent with uploaded files.
  • Large transcripts are chunked and forwarded to AI Guard for policy-violation detection.
  • Detections can be reviewed and investigated in TrendAI Vision One’s AI Application Security dashboard.
  • The Anthropic Compliance Access Key stays in the customer’s infrastructure; conversation content is sent to self-hosted or TrendAI-hosted AI Guard.
  • Deployment options are an AWS CloudFormation stack or a Kubernetes Helm chart. Kubernetes API-key Secrets must be created by the customer.

Article Details

Defense Focus
Collect Claude Enterprise conversations and scan them for policy violations, with detections available for review and investigation.
Detection Methods
  • Run the collector on a configurable schedule to discover active chat IDs in the Anthropic Compliance API Activity Feed, excluding deleted chats.
  • Retrieve conversation transcripts and send chunked content to AI Guard for AI-based policy violation detection.
  • Review and investigate flagged interactions in the AI Application Security dashboard, filtering by the collector's application name.
Data Sources
  • Anthropic Compliance API Activity Feed
  • Claude conversation content, including prompts, model responses, and text sent alongside uploaded files
Platforms
  • AI Application Security dashboard
  • AWS CloudFormation
  • Kubernetes
Defensive Actions
  • Deploy the collector as an AWS CloudFormation stack or a Helm chart on Kubernetes.
  • Configure the collection schedule; the default interval is every four hours.
  • Keep the Anthropic Compliance Access Key within your infrastructure and provide API keys through the deployment's secrets mechanism.
  • Choose self-hosted or TrendAI-hosted AI Guard for scanning.
  • For Kubernetes deployments, create the API-key Secret before installation; the chart does not create or populate Secret material.
  • Optionally use a Kubernetes NetworkPolicy to restrict egress.

Vendors

Amazon Web ServicesYou can deploy the collector as an AWS CloudFormation stack or as a Helm chart onAnthropicIntegrate with the Anthropic Compliance API by deploying the Claude Compliance Collector, a customer-deployed collector that automatically retrieves Claude Enterprise conversation data and scans it for policy violationsTrendAIor TrendAI-hosted AI Guard.

Products

AI Application SecurityAI Application Security dashboard, giving you the visibility and audit trail thatAI Guardautomatically retrieves Claude Enterprise conversation data and scans it for policy violations using AI Guard.Anthropic Compliance APIIntegrate with the Anthropic Compliance API by deploying the Claude Compliance Collector, a customer-deployed collector that automatically retrieves Claude Enterprise conversation data and scans it for policy violationsAWS CloudFormationYou can deploy the collector as an AWS CloudFormation stack or as a Helm chart onClaude Compliance CollectorIntegrate with the Anthropic Compliance API by deploying the Claude Compliance Collector, a customer-deployed collector that automatically retrieves Claude Enterprise conversation data and scans it for policy violationsClaude Enterprisethe Claude Compliance Collector, a customer-deployed collector that automatically retrieves Claude Enterprise conversation data and scans it for policy violations using AI Guard.CloudWatchCloudWatch Log GroupsEventBridgeEventBridge scheduleHelmYou can deploy the collector as an AWS CloudFormation stack or as a Helm chart onIAMIAM rolesKubernetesKubernetes. Both deployment methods run the same collection and scanning logic andLambdaLambda functionsSecrets ManagerSecrets Manager secrets (stores API keys encrypted at rest)SQSSQS queueTrendAI Vision OneAI Guard detections appear in the TrendAI Vision One™ AI Application Security dashboard, where you can filter results by the collector's application name and investigate flagged interactions. For more information about

Related Articles