Claude Compliance Source

The Sumo Logic source for Claude Compliance enables you to collect chat messages from Claude into Sumo Logic.

Claude provides advanced AI solutions for enterprises, offering secure, compliant, and customizable conversational AI capabilities to improve productivity while meeting organizational governance and regulatory needs.

The Compliance API enables enterprise customers to access structured chat logs and metadata to support auditing, compliance, and security requirements.

Data collected

Polling Interval	Data
5 min	Messages

Setup

Vendor configuration

You are required to provide the Organization UUID and API Key to configure the Claude Compliance source.

Steps to Get Organization UUID:

• After logging in to claude.ai, navigate to Settings → Account.
• Your Organization UUID is displayed in the Account details section.

Steps to Generate API Key:

Keys are created in the Compliance access keys section of Data Management Settings.

1. Click Create key to name your key.
2. Name the key and select its scopes. For this c2c we need the scope read:compliance_user_data
3. Receive a secret access key and store it securely.

Note: If you do not see the Compliance access keys section, it means that either you are not a Primary Owner of the organization, or the Compliance API is not enabled for your organization. The Primary Owner needs to enable it in the Data and Privacy section of your organization's settings.

Source configuration

note

Claude Compliance logs can be collected using this source for chat messages. To collect activity logs, use the Universal Collector.

When you create a Claude Compliance Source, you add it to a Hosted Collector. Before creating the source, identify the Hosted Collector you want to use or create a new Hosted Collector. For instructions, see Configure a Hosted Collector and Source.

To configure a Claude Compliance Source, follow the steps below:

1. New UI. In the Sumo Logic main menu, select Data Management, and then under Data Collection select Collection. You can also click the Go To... menu at the top of the screen and select Collection.
   Classic UI. In the main Sumo Logic menu, select Manage Data > Collection > Collection.
2. On the Collection page, click Add Source next to a Hosted Collector.
3. Search for and select Claude Compliance.
4. Enter a Name for the Source. The description is optional.
5. (Optional) For Source Category, enter any string to tag the output collected from the Source. Category metadata is stored in a searchable field called _sourceCategory.
6. (Optional) Fields. Click the +Add button to define the fields you want to associate. Each field needs a name (key) and a value.
   • A green circle with a check mark is shown when the field exists and is enabled in the Fields table schema.
   • An orange triangle with an exclamation point is shown when the field doesn't exist in the Fields table schema. In this case, you'll see an option to automatically add or enable the nonexistent fields to the Fields table schema. If a field is sent to Sumo Logic that does not exist in the Fields schema, it is ignored, known as dropped.
7. Organization UUID. Enter the Organization UUID collected from the Claude Console.
8. API Key. Enter the API Key generated from the Claude Console.
9. Polling Interval. The polling interval is set for 5 minutes by default and can be configured to a maximum of 24 hours. You can adjust it based on your needs. This sets how often the source checks for new data.
10. Processing Rules. Configure any desired filters, such as allowlist, denylist, hash, or mask, as described in Create a Processing Rule.
11. When you are finished configuring the Source, click Save.

info

After configuring the Claude Compliance source, consider installing the Sumo Logic app for Claude Compliance to visualize and analyze the collected data using prebuilt dashboards and monitor alerts.

JSON schema

Sources can be configured using UTF-8 encoded JSON files with the Collector Management API. See Use JSON to Configure Sources for details.

Parameter	Type	Value	Required	Description
schemaRef	JSON Object	{"type":"Claude Compliance"}	Yes	Define the specific schema type.
sourceType	String	"Universal"	Yes	Type of source.
config	JSON Object	Configuration object	Yes	Source type specific values.

Configuration Object

Parameter	Type	Required	Default	Description	Example
name	String	Yes	null	Type a desired name of the source. The name must be unique per Collector. This value is assigned to the metadata field _source.	"mySource"
description	String	No	null	Type a description of the source.	"Testing source"
category	String	No	null	Type a category of the source. This value is assigned to the metadata field _sourceCategory. See best practices for details.	"mySource/test"
fields	JSON Object	No	null	JSON map of key-value fields (metadata) to apply to the Collector or Source. Use the boolean field _siemForward to enable forwarding to SIEM.	{"_siemForward": false, "fieldA": "valueA"}
orgUUID	String	Yes	null	Your Organization UUID from Claude Console.	fbc16730-e0af-40gg-a0be-6057d1741b97
apiKey	String	Yes	null	API Key of the account.	sk-ant-XXXXXXXXXXXXXXX
pollingIntervalMinutes	String	Yes	5 minutes	Time interval (in minutes) after which the source will check for new data.	5m

JSON example

static/files/c2c/claude-compliance/example.json

loading...

See full example on GitHub

Terraform example

static/files/c2c/claude-compliance/example.tf

loading...

See full example on GitHub

Limitations

• Re-ingestion after 25 hours: If a chat message is updated more than 25 hours after initial ingestion, the source will re-ingest all messages from that chat, which may result in duplicate logs in Sumo Logic.
• Historical data backfill: If the source experiences downtime or is temporarily disabled, it will automatically backfill data when restarted. The maximum historical data retrieval period is 30 days from the current date.
• Message structure: Each log entry in Sumo Logic contains a single chat message along with its complete metadata. To view all messages from a conversation, aggregate the logs using the chat ID field.
• As the Claude Compliance API continues to evolve, updates may alter conversation data or API behavior, potentially impacting integration consistency.

FAQ

info

Click here for more information about Cloud-to-Cloud sources.