demisto · joeymizrahi · Aug 24, 2026 · Aug 24, 2026 · Aug 25, 2026
diff --git a/Packs/AnthropicClaude/ReleaseNotes/1_3_2.md b/Packs/AnthropicClaude/ReleaseNotes/1_3_2.md
@@ -0,0 +1,6 @@
+
+#### Integrations
+
+##### Anthropic Claude
+
+- Extracted the Compliance client's constructor, ``x-api-key`` UCP override, ``http_delete``, and the two irreversible delete commands (`claude-chat-file-delete` and `claude-project-document-delete`) into the shared `AnthropicClaudeApiModule`. Behaviour is unchanged. This enables the new Anthropic Claude Standard Connector satellite pack to share the same client and command code.
diff --git a/Packs/AnthropicClaude/pack_metadata.json b/Packs/AnthropicClaude/pack_metadata.json
@@ -2,7 +2,7 @@
     "name": "Anthropic Claude",
     "description": "Designed to assist security professionals with security investigations, threat hunting, and anomaly detection, leveraging Anthropic Claude's natural language conversational capabilities.",
     "support": "xsoar",
-    "currentVersion": "1.3.1",
+    "currentVersion": "1.3.2",
     "author": "Cortex XSOAR",
     "url": "https://www.paloaltonetworks.com/cortex",
     "email": "",

diff --git a/Packs/AnthropicClaudeStandardConnector/.pack-ignore b/Packs/AnthropicClaudeStandardConnector/.pack-ignore
diff --git a/Packs/AnthropicClaudeStandardConnector/.secrets-ignore b/Packs/AnthropicClaudeStandardConnector/.secrets-ignore
@@ -0,0 +1,3 @@
+https://api.anthropic.com/
+https://platform.claude.com
+https://platform.claude.com/docs/en/manage-claude/compliance-api-access
diff --git a/...nnector/Integrations/AnthropicClaudeStandardConnector/AnthropicClaudeStandardConnector.py b/...nnector/Integrations/AnthropicClaudeStandardConnector/AnthropicClaudeStandardConnector.py
@@ -0,0 +1,14 @@
+import demistomock as demisto  # noqa: F401
+from CommonServerPython import *  # noqa: F401
+
+from AnthropicClaudeApiModule import *  # noqa: E402
+
+
+def main():
+    run_anthropic_claude_integration()
+
+
+from CommonServerUserPython import *  # noqa: E402  # pylint: disable=wrong-import-position
+
+if __name__ in ("__main__", "__builtin__", "builtins"):
+    main()
diff --git a/...nector/Integrations/AnthropicClaudeStandardConnector/AnthropicClaudeStandardConnector.yml b/...nector/Integrations/AnthropicClaudeStandardConnector/AnthropicClaudeStandardConnector.yml
@@ -0,0 +1,75 @@
+category: Analytics & SIEM
+provider: Anthropic
+sectionorder:
+- Connect
+commonfields:
+  id: AnthropicClaudeStandardConnector
+  version: -1
+configuration:
+- display: ''
+  displaypassword: Compliance Access Key
+  hiddenusername: true
+  name: compliance_apikey
+  required: false
+  section: Connect
+  type: 9
+  additionalinfo: The Anthropic Compliance Access Key (sk-ant-api01-...) used for the delete commands. Requires the delete:compliance_user_data scope.
+- display: Trust any certificate (not secure)
+  name: insecure
+  required: false
+  type: 8
+  section: Connect
+- display: Use system proxy settings
+  name: proxy
+  required: false
+  type: 8
+  section: Connect
+description: 'This integration is configured automatically as part of the Anthropic Claude Standard Connector. Do not configure this integration directly — set it up from the connector page instead.'
+display: Anthropic Claude (Standard Connector)
+name: AnthropicClaudeStandardConnector
+script:
+  commands:
+  - arguments:
+    - description: 'The Claude file ID to permanently delete (e.g., claude_file_...). Deletes a file uploaded in a conversation or a project binary file (project_file). This is an irreversible hard delete.'
+      name: file_id
+      required: true
+    description: 'Permanently delete a Claude file (a conversation file or a project binary file) via the Compliance API. This is an irreversible hard delete, and it requires a Compliance Access Key with the delete:compliance_user_data scope. Deleting an already-deleted or unknown file ID succeeds (idempotent).'
+    execution: true
+    name: claude-chat-file-delete
+    outputs:
+    - contextPath: AnthropicClaude.DeletedFile.id
+      description: The ID of the file that was deleted.
+      type: String
+    - contextPath: AnthropicClaude.DeletedFile.type
+      description: The deletion confirmation type (claude_file_deleted).
+      type: String
+    - contextPath: AnthropicClaude.DeletedFile.Deleted
+      description: The deletion result for the file (true when deleted).
+      type: Boolean
+  - arguments:
+    - description: 'The Claude project document ID to permanently delete (e.g., claude_proj_doc_...). Applies to project plain-text documents (project_doc). This is an irreversible hard delete.'
+      name: document_id
+      required: true
+    description: 'Permanently delete a Claude project document (a plain-text project_doc) via the Compliance API. This is an irreversible hard delete, and it requires a Compliance Access Key with the delete:compliance_user_data scope. Deleting an already-deleted or unknown document ID succeeds (idempotent).'
+    execution: true
+    name: claude-project-document-delete
+    outputs:
+    - contextPath: AnthropicClaude.DeletedProjectDocument.id
+      description: The ID of the project document that was deleted.
+      type: String
+    - contextPath: AnthropicClaude.DeletedProjectDocument.type
+      description: The deletion confirmation type (claude_project_document_deleted).
+      type: String
+    - contextPath: AnthropicClaude.DeletedProjectDocument.Deleted
+      description: The deletion result for the project document (true when deleted).
+      type: Boolean
+  dockerimage: demisto/parse-emails:0.1.48.10569905
+  runonce: false
+  script: ''
+  subtype: python3
+  type: python
+fromversion: 8.15.0
+tests:
+- No tests
+marketplaces:
+- platform
diff --git a/...nthropicClaudeStandardConnector/AnthropicClaudeStandardConnector_description.md b/...nthropicClaudeStandardConnector/AnthropicClaudeStandardConnector_description.md
@@ -0,0 +1,6 @@
+This integration is configured automatically as part of the **Anthropic Claude Standard Connector**. Do not configure this integration directly — set it up from the connector page instead.
+
+It exposes only the two irreversible Compliance API delete commands
+(`claude-chat-file-delete`, `claude-project-document-delete`) and requires
+the Anthropic Compliance Access Key (`sk-ant-api01-...`) with the
+`delete:compliance_user_data` scope.
diff --git a/...ons/AnthropicClaudeStandardConnector/AnthropicClaudeStandardConnector_image.png b/...ons/AnthropicClaudeStandardConnector/AnthropicClaudeStandardConnector_image.png
diff --git a/...or/Integrations/AnthropicClaudeStandardConnector/AnthropicClaudeStandardConnector_test.py b/...or/Integrations/AnthropicClaudeStandardConnector/AnthropicClaudeStandardConnector_test.py
@@ -0,0 +1,44 @@
+"""Sanity tests for the AnthropicClaudeStandardConnector shim integration.
+
+Full behavioural coverage lives in the AnthropicClaudeApiModule tests; this file
+exists only to confirm the shim wires through to the ApiModule correctly. The
+satellite integration exposes only the two delete commands in its YAML, but the
+shared ``run_anthropic_claude_integration()`` function still holds the full
+dispatcher — the YAML is the enforcement boundary.
+"""
+
+import pytest
+
+import AnthropicClaudeStandardConnector as integration_module
+
+
+def test_shim_imports_run_entry_point():
+    assert hasattr(
+        integration_module, "run_anthropic_claude_integration"
+    ), "AnthropicClaudeApiModule.run_anthropic_claude_integration must be importable via the shim"
+
+
+def test_shim_imports_delete_commands():
+    """The satellite integration YAML surfaces exactly these two delete commands."""
+    assert hasattr(integration_module, "chat_file_delete_command")
+    assert hasattr(integration_module, "project_document_delete_command")
+
+
+def test_shim_imports_compliance_client():
+    """The delete commands require the ComplianceClient (Compliance Access Key auth)."""
+    assert hasattr(integration_module, "ComplianceClient")
+
+
+def test_main_delegates_to_api_module(mocker):
+    mock_run = mocker.patch("AnthropicClaudeStandardConnector.run_anthropic_claude_integration")
+    integration_module.main()
+    mock_run.assert_called_once_with()
+
+
+def test_main_propagates_exceptions(mocker):
+    mocker.patch(
+        "AnthropicClaudeStandardConnector.run_anthropic_claude_integration",
+        side_effect=RuntimeError("boom"),
+    )
+    with pytest.raises(RuntimeError, match="boom"):
+        integration_module.main()
diff --git a/...ClaudeStandardConnector/Integrations/AnthropicClaudeStandardConnector/README.md b/...ClaudeStandardConnector/Integrations/AnthropicClaudeStandardConnector/README.md
@@ -0,0 +1,70 @@
+Wired to the Anthropic Claude connector to expose two irreversible hard-delete commands from the Anthropic Compliance API. Configured automatically as part of the connector setup — do not add an instance of this integration directly.
+
+## Authentication
+
+Authenticates with the Anthropic Compliance Access Key (`sk-ant-api01-...`) via the `x-api-key` header. The key must have the `delete:compliance_user_data` scope.
+
+- On the ConnectUs (UCP) path (standard connector, this integration's normal deployment), the credential is supplied by the connector profile and injected at request time.
+- On the legacy XSOAR path (direct configuration, not recommended), set the "Compliance Access Key" integration parameter.
+
+For details on obtaining a Compliance Access Key, see the [Anthropic Compliance API documentation](https://platform.claude.com/docs/en/manage-claude/compliance-api-access).
+
+## Configuration
+
+This integration is configured automatically as part of the **Anthropic Claude Standard Connector**. Set it up from the connector page, not from **Settings → Integrations**.
+
+| Parameter | Description | Required |
+| --- | --- | --- |
+| Compliance Access Key | The Anthropic Compliance Access Key. Requires the `delete:compliance_user_data` scope. | True |
+| Trust any certificate (not secure) | Bypass TLS certificate validation. | False |
+| Use system proxy settings | Route requests through the system HTTPS proxy. | False |
+
+## Commands
+
+You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook.
+
+### claude-chat-file-delete
+
+***
+Permanently delete a Claude file (a conversation file or a project binary file) via the Compliance API. This is an irreversible hard delete, and it requires a Compliance Access Key with the `delete:compliance_user_data` scope. Deleting an already-deleted or unknown file ID succeeds (idempotent).
+
+#### Base Command
+
+`claude-chat-file-delete`
+
+#### Input
+
+| **Argument Name** | **Description** | **Required** |
+| --- | --- | --- |
+| file_id | The Claude file ID to permanently delete (e.g., `claude_file_...`). Deletes a file uploaded in a conversation or a project binary file (`project_file`). This is an irreversible hard delete. | Required |
+
+#### Context Output
+
+| **Path** | **Type** | **Description** |
+| --- | --- | --- |
+| AnthropicClaude.DeletedFile.id | String | The ID of the file that was deleted. |
+| AnthropicClaude.DeletedFile.type | String | The deletion confirmation type (`claude_file_deleted`). |
+| AnthropicClaude.DeletedFile.Deleted | Boolean | The deletion result for the file (`true` when deleted). |
+
+### claude-project-document-delete
+
+***
+Permanently delete a Claude project document (a plain-text `project_doc`) via the Compliance API. This is an irreversible hard delete, and it requires a Compliance Access Key with the `delete:compliance_user_data` scope. Deleting an already-deleted or unknown document ID succeeds (idempotent).
+
+#### Base Command
+
+`claude-project-document-delete`
+
+#### Input
+
+| **Argument Name** | **Description** | **Required** |
+| --- | --- | --- |
+| document_id | The Claude project document ID to permanently delete (e.g., `claude_proj_doc_...`). Applies to project plain-text documents (`project_doc`). This is an irreversible hard delete. | Required |
+
+#### Context Output
+
+| **Path** | **Type** | **Description** |
+| --- | --- | --- |
+| AnthropicClaude.DeletedProjectDocument.id | String | The ID of the project document that was deleted. |
+| AnthropicClaude.DeletedProjectDocument.type | String | The deletion confirmation type (`claude_project_document_deleted`). |
+| AnthropicClaude.DeletedProjectDocument.Deleted | Boolean | The deletion result for the project document (`true` when deleted). |
diff --git a/Packs/AnthropicClaudeStandardConnector/README.md b/Packs/AnthropicClaudeStandardConnector/README.md
@@ -0,0 +1,12 @@
+# Anthropic Claude (Standard Connector)
+
+Satellite pack of the Anthropic Claude integration used for the Standard
+Connector deployment. It ships a narrow integration exposing only the two
+irreversible Compliance API delete commands
+(`claude-chat-file-delete`, `claude-project-document-delete`), sharing all
+its code with the parent Anthropic Claude pack via the
+`AnthropicClaudeApiModule`.
+
+This pack is configured automatically as part of the Anthropic Claude
+Standard Connector. Do **not** configure the integration directly — set it up
+from the connector page instead.
diff --git a/Packs/AnthropicClaudeStandardConnector/ReleaseNotes/1_0_0.md b/Packs/AnthropicClaudeStandardConnector/ReleaseNotes/1_0_0.md
@@ -0,0 +1,6 @@
+
+#### Integrations
+
+##### New: Anthropic Claude (Standard Connector)
+
+- Initial release of the Anthropic Claude Standard Connector satellite pack. Exposes the two irreversible Compliance API delete commands (`claude-chat-file-delete` and `claude-project-document-delete`) for use through the Anthropic Claude connector on the Cortex platform. Shares its client code with the parent Anthropic Claude pack via the `AnthropicClaudeApiModule`.
diff --git a/Packs/AnthropicClaudeStandardConnector/pack_metadata.json b/Packs/AnthropicClaudeStandardConnector/pack_metadata.json
@@ -0,0 +1,29 @@
+{
+    "name": "Anthropic Claude (Standard Connector)",
+    "description": "Satellite pack of Anthropic Claude used for the Standard Connector deployment. Shares core logic with the Anthropic Claude pack via the AnthropicClaudeApiModule.",
+    "support": "xsoar",
+    "currentVersion": "1.0.0",
+    "author": "Cortex XSOAR",
+    "url": "https://www.paloaltonetworks.com/cortex",
+    "email": "",
+    "created": "2026-08-24T00:00:00Z",
+    "categories": [
+        "Analytics & SIEM"
+    ],
+    "tags": [],
+    "useCases": [],
+    "keywords": [
+        "Anthropic",
+        "Claude"
+    ],
+    "marketplaces": [
+        "platform"
+    ],
+    "supportedModules": [
+        "agentix",
+        "cloud_runtime_security",
+        "xsiam",
+        "edr",
+        "cloud"
+    ]
+}
diff --git a/Packs/ApiModules/.secrets-ignore b/Packs/ApiModules/.secrets-ignore
@@ -1790,3 +1790,5 @@ YOUNG
 https://some_url
 https://c.sharepoint.com
 https://e.sharepoint.com
+https://api.anthropic.com
+https://console.anthropic.com