Inbound Traffic from Anthropic IP Range - GRAVWELL Rule

Arnold Chan@slaz

•updated Sep 12, 2026•1•0•0

This rule monitors various logs (email, entra, device, graph, cloud) for IP addresses (source or remote) that match a specific CIDR range (160.79.104.0/21). This is typically used to identify traffic originating from or communicating with infrastructure identified as malicious or suspicious by threat intelligence.