Claude Compliance Source

The Sumo Logic source for Claude Compliance enables you to collect chat messages and activity logs from Claude into Sumo Logic.

Claude provides advanced AI solutions for enterprises, offering secure, compliant, and customizable conversational AI capabilities to improve productivity while meeting organizational governance and regulatory needs.

The Compliance API enables enterprise customers to access structured chat logs, activity events, and metadata to support auditing, compliance, and security requirements.

Data collected

Polling Interval	Data
5 min	Chat Messages
5 min	Activity Logs

Setup

Vendor configuration

You are required to provide the Organization UUID and API Key to configure the Claude Compliance source.

Steps to get Organization UUID

1. Log in to claude.ai.
2. Navigate to Settings > Account.
3. Collect your Organization UUID from the Account details section.

Steps to generate API Key

Keys are created in the Compliance access keys section of Data Management Settings.

1. Click Create key to name your key.
2. Name the key and select its scopes based on the data you want to collect:
   • read:compliance_user_data. Required to collect chat messages.
   • read:compliance_activities. Required to collect activity logs.
3. Receive a secret access key and store it securely.

note

If you do not see the Compliance access keys section, it means that either you are not a Primary Owner of the organization, or the Compliance API is not enabled for your organization. The Primary Owner needs to enable it in the Data and Privacy section of your organization's settings.

Source configuration

note

This source can collect both chat messages and activity logs. You can enable or disable each data type independently using the Data Collection settings described in the configuration steps below.

When you create a Claude Compliance Source, you add it to a Hosted Collector. Before creating the source, identify the Hosted Collector you want to use or create a new Hosted Collector. For instructions, see Configure a Hosted Collector and Source.

To configure a Claude Compliance Source, follow the steps below:

1. New UI. In the Sumo Logic main menu, select Data Management, and then under Data Collection select Collection. You can also click the Go To... menu at the top of the screen and select Collection.
   Classic UI. In the main Sumo Logic menu, select Manage Data > Collection > Collection.
2. On the Collection page, click Add Source next to a Hosted Collector.
3. Search for and select Claude Compliance.
4. Enter a Name for the Source. The description is optional.
5. (Optional) For Source Category, enter any string to tag the output collected from the Source. Category metadata is stored in a searchable field called _sourceCategory.
6. (Optional) Fields. Click the +Add button to define the fields you want to associate. Each field needs a name (key) and a value.
   • A green circle with a check mark is shown when the field exists and is enabled in the Fields table schema.
   • An orange triangle with an exclamation point is shown when the field doesn't exist in the Fields table schema. In this case, you'll see an option to automatically add or enable the nonexistent fields to the Fields table schema. If a field is sent to Sumo Logic that does not exist in the Fields schema, it is ignored, known as dropped.
7. Organization UUID. Enter the Organization UUID collected from the Claude Console.
8. API Key. Enter the API Key generated from the Claude Console.
9. Polling Interval. The polling interval is set for 5 minutes by default and can be configured to a maximum of 24 hours. You can adjust it based on your needs. This sets how often the source checks for new data.
10. Data Collection. Choose what types of data to collect. At least one must be selected.
    • Collect Chat Messages. Selected by default. Collects conversation messages from Claude chats.
    • Collect Activities. Collects compliance activity events covering authentication, chat, file, project, administrative, and platform actions. For the full list of activity types, see Query the Activity Feed in the Claude documentation.
11. Processing Rules. Configure any desired filters, such as allowlist, denylist, hash, or mask, as described in Create a Processing Rule.
12. When you are finished configuring the Source, click Save.

info

After configuring the Claude Compliance source, consider installing the Sumo Logic app for Claude Compliance to visualize and analyze the collected data using prebuilt dashboards and monitor alerts.

JSON schema

Sources can be configured using UTF-8 encoded JSON files with the Collector Management API. See Use JSON to Configure Sources for details.

Parameter	Type	Value	Required	Description
schemaRef	JSON Object	{"type":"Claude Compliance"}	Yes	Define the specific schema type.
sourceType	String	"Universal"	Yes	Type of source.
config	JSON Object	Configuration object	Yes	Source type specific values.

Configuration Object

Parameter	Type	Required	Default	Description	Example
name	String	Yes	null	Type a desired name of the source. The name must be unique per Collector. This value is assigned to the metadata field _source.	"mySource"
description	String	No	null	Type a description of the source.	"Testing source"
category	String	No	null	Type a category of the source. This value is assigned to the metadata field _sourceCategory. See best practices for details.	"mySource/test"
fields	JSON Object	No	null	JSON map of key-value fields (metadata) to apply to the Collector or Source. Use the boolean field _siemForward to enable forwarding to SIEM.	{"_siemForward": false, "fieldA": "valueA"}
orgUUID	String	Yes	null	Your Organization UUID from Claude Console.	fbc16730-e0af-40gg-a0be-6057d1741b97
apiKey	String	Yes	null	API Key of the account.	sk-ant-XXXXXXXXXXXXXXX
pollingIntervalMinutes	String	Yes	5 minutes	Time interval (in minutes) after which the source will check for new data.	5m
collectChatMessages	Boolean	No	true	Enable collection of chat conversation messages. At least one of collectChatMessages or collectActivities must be true.	false
collectActivities	Boolean	No	false	Enable collection of compliance activity events. At least one of collectChatMessages or collectActivities must be true.	true

JSON example

static/files/c2c/claude-compliance/example.json

loading...

See full example on GitHub

Terraform example

static/files/c2c/claude-compliance/example.tf

loading...

See full example on GitHub

Limitations

Chat messages

• Re-ingestion after 25 hours. If a chat message is updated more than 25 hours after initial ingestion, the source will re-ingest all messages from that chat, which may result in duplicate logs in Sumo Logic.
• Historical data backfill. If the source experiences downtime or is temporarily disabled, it will automatically backfill data when restarted. The maximum historical data retrieval period is 30 days from the current date.
• Message structure. Each log entry in Sumo Logic contains a single chat message along with its complete metadata. To view all messages from a conversation, aggregate the logs using the chat ID field.

Activity logs

• Activity event delay. Activity events are collected with a 5-minute lag to account for indexing delay on Anthropic's side. Events will always appear at least 5 minutes after they occurred.
• Activity historical data. If the source experiences downtime or is temporarily disabled, it will automatically backfill data when restarted. The maximum historical data retrieval period is 30 days from the current date.

General

• As the Claude Compliance API continues to evolve, updates may alter conversation data or API behavior, potentially impacting integration consistency.

Troubleshooting

Anthropic API returns 404 status code

If the source returns the following error:

{"type":"error","error":{"type":"not_found_error","message":"Not found","details":{"error_visibility":"user_facing"}},"request_id":"req_XXXX"}

This error can occur due to the following reasons:

• Invalid or incorrect API key. Verify that the API key configured for the source is correct and valid.
• Valid API key, error persists. If the API key is confirmed valid but the error still occurs, past investigations have traced this to an issue on the Anthropic endpoint side. In this case:
  • Restart the source and confirm whether it resumes working as expected.
  • If the error still persists after restarting, contact the Anthropic support team regarding this issue.

FAQ

info

Click here for more information about Cloud-to-Cloud sources.