Claude AI Activity and False Positive Alerts

[J.MorenoCiudad]

Hello,

Recently, I’ve been noticing quite a few false positive alerts related to the use of Claude AI.

I’m investigating these alerts and trying to understand exactly what Claude is doing on the endpoint. I would like to review the command history and the actions performed by the application, but I cannot find enough information directly in the alert details.

Is there any way to obtain more detailed logs or telemetry for Claude? For example, is there a specific folder or log location on the endpoint where I could retrieve additional information about the commands/actions performed by the application?

I’m particularly interested in understanding what commands Claude is executing, which processes it is launching, and what files or system resources it is accessing, in order to determine whether the alerts are legitimate activity or false positives.

Any guidance on where I could find this information would be greatly appreciated.

Thanks in advance!

[susekar]

Hello @J.MorenoCiudad ,

Greetings for the day.

To investigate whether Claude AI activity triggered legitimate alerts or false positives, we recommend the following steps:

-Retrieve alert data: In Cortex XDR, navigate to Incident Response → Incidents → Alerts Table, right-click the relevant alert, and select Retrieve Additional Data → Retrieve Alert Data to obtain detailed forensic information.

-Review process activity: Use Query Builder and Causality View to examine process trees, command-line arguments, file activity, and script execution associated with Claude.

-Check for false positives: Review the triggered detection rule and correlate it with the observed activity. Legitimate AI coding tools may trigger behavioral or script-based detections.

-Apply exceptions if required: If the activity is confirmed benign, consider a narrowly scoped alert exception based on the causality group and process details, following your security team's approval.

Recommendation: Validate the complete process chain and command execution before classifying the alert as a false positive or creating an exception.

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution".

Thanks & Regards,
S. Subashkar Sekar