This article shows how to use the Claude Compliance API to feed full chat and file content into your SIEM, then write detections for AI-specific threats that live in the content. It covers prompt injections in uploaded files, jailbreaks, system-prompt leaks, data-laundering requests, sensitive disclosures, and insider data-flow risks.

• Claude's Compliance API streams full chat and file content into your SIEM, not just auth/admin logs—so an unrecognized identity querying compliance_api_accessed can see every chat in the org.
• Uploaded files can hide jailbreak instructions via zero-width characters, white-on-white text, or base64 blobs, so file_uploaded/project_document_created events need scanning for instruction-like language and suspicious encoding.
• Detections should focus on the assistant's output, not the prompt: a jailbreak attempt only matters if disallowed content or leaked system instructions actually appear in the response.
• Requests to encode, paraphrase, or strip PII from text are exfiltration red flags, and only the model's actual response confirms whether sensitive data got through.