Skip to content
Integration · Claude Enterprise Compliance API

Audit Every Claude SessionControl Every Claude ActionIn Real Time

Neo correlates records from the Claude Compliance API with endpoint telemetry from the Neo Sensor. Every Claude session is attributed to a user, and actions on endpoints are checked against policies before they run.

Get a Demo How It Works
  • Claude Code
  • Claude Cowork
  • Claude Desktop
  • claude.ai
Neo · Claude activity Example
Neo Sensor Compliance API
  1. 14:32:07

    claude-code · engineering laptop

    read ~/.aws/credentials

    Blocked · 9 ms Sensor
  2. 14:31:52

    cowork · finance

    upload ar_ledger_q3.csv (18.4 MB) to mcp: sheets-sync

    Held · approval Sensor
  3. 14:29:15

    claude.ai · unmanaged device

    chat with attached msa_signed.pdf

    PII flagged Compliance API
  4. 14:20:03

    org · admin · role change

    Claude Code access granted to group: contractors

    Logged Compliance API
  5. 14:02:41

    cowork · mobile · remote session

    session transcript retrieved, 14 tool calls

    Recorded Compliance API
Overview

Claude Activity Spans Endpoints, Browsers, and Agent Runtimes

Claude Code executes shell commands and modifies repositories on developer machines. Cowork agents read local files and pass data to connected MCP servers. claude.ai sessions ingest contracts, customer records, and source code as attachments.

The Claude Compliance API gives Claude Enterprise security teams programmatic access to this activity: Cowork and Claude Code session transcripts, claude.ai chats and uploaded files, the activity feed of user and admin events, and the directory of users, roles, and groups. It is the authoritative record for the Claude organization, available after each event completes.

The Neo Sensor runs on the endpoint and observes Claude processes directly. It evaluates each action against policy at execution time and can allow, hold, or block it. Neo merges both sources into one audit trail backed by inline enforcement.

What becomes visible in Neo

  1. Every Claude surface, one inventory

    Code, Cowork, Desktop and claude.ai, with the MCP servers, skills and extensions each one uses.

  2. Sensitive data in chats and files

    Contracts, PII, secrets and source code, including sessions from devices Neo doesn't manage.

  3. Human-to-agent attribution

    Each action mapped to the user, the Claude session, and the agent process that executed it.

  4. Org changes and settings

    Role changes, group membership and the settings in force for each linked organization.

Two sources, one record

Most of This Activity Is Already Visible to the Neo Sensor

Integrations built only on the Compliance API see Claude activity after it occurs. The Neo Sensor captures most of the same events at the endpoint as they happen. Neo uses the API to fill what the endpoint can't see, such as org-level admin events, settings, and sessions on devices Neo doesn't manage, and attaches the full transcript to the events the sensor caught.

  • Claude Code tool calls, shell commands, file reads

    What the agent touched on the machine

    Neo Sensor
    Real time
    Compliance API
    Session transcript
    Neo with both
    Enforced and audited

  • MCP servers, skills and extensions in use

    Installed and active, per endpoint

    Neo Sensor
    Live inventory
    Compliance API
    Calls in transcripts
    Neo with both
    Inventory and risk score

  • Cowork agent actions

    Files opened, data sent to connected tools

    Neo Sensor
    Real time
    Compliance API
    Session transcript
    Neo with both
    Enforced and audited

  • Chats and uploads on managed devices

    Desktop app and browser

    Neo Sensor
    Real time
    Compliance API
    Full transcript
    Neo with both
    Correlated

  • Sessions off managed devices

    Personal laptops, phones, Cowork on web and mobile

    Neo Sensor
    Not visible
    Compliance API
    Full transcript
    Neo with both
    Covered

  • Admin and org events

    Roles, groups, sharing, settings

    Neo Sensor
    Not visible
    Compliance API
    Logged
    Neo with both
    Covered

  • Stop or hold an action before it runs

    Pre-execution enforcement

    Neo Sensor
    Inline, in milliseconds
    Compliance API
    After the fact
    Neo with both
    Inline, in milliseconds
  • Live, on the endpoint
  • Record, after the fact
  • Not available from this source
How it works

How Neo Combines Sensor Data with the Compliance API

The sensor intercepts Claude actions at execution time. The Compliance API connector backfills org-level records on a polling interval. Neo deduplicates events from both sources, enriches them with risk data from Neoverse, and evaluates them against policy.

Where Claude runs

Claude Code
Claude Cowork
Claude Desktop
claude.ai

How Neo sees it

Neo Sensor

Intercepts process, file, and network activity from Claude clients at execution time.

Inline · real time

Claude Compliance API

Org-wide records from Anthropic: session transcripts, chats, files, admin events, users and settings.

Org-wide · after the fact

Neo platform

Correlation and policy engine

  • Neoverse enrichment and risk scoring
  • Human, agent, action attribution chain
  • Natural-language policy authoring
  • Cross-source event deduplication

What you get

Verdicts

Allow, hold for approval, or block

Alerts

To your SIEM and SOC queue

Audit evidence

Immutable trail per session

Inline enforcement

The Compliance API provides a retrospective record. The Neo Sensor enforces policy on the endpoint before an action completes. Integrations built only on the Compliance API can generate alerts, but cannot prevent an upload or command that has already executed.

In practice

Blocking Data Exfiltration from a Cowork Agent

Example scenario

A finance analyst asks a Cowork agent to reconcile Q3 receivables. The agent tries to send the full AR ledger, 41,000 customer rows, to a third-party MCP server.

With Compliance API data alone, this event is detected after the upload completes. With Neo, the sensor holds the call in milliseconds, and the API record supplies the full session context.

  1. 14:31:52.104

    Sensor Detected

    Cowork agent calls mcp: sheets-sync → upload with ar_ledger_q3.csv, 18.4 MB

  2. 14:31:52.113

    Sensor Policy

    Matches hold: exports over 10 MB to unapproved MCP. Action held, SecOps paged.

  3. 14:32:33

    Sensor Decision

    A SecOps analyst denies it after 41 seconds. Upload blocked, and the agent receives a policy denial.

  4. 14:45:10

    Compliance API Enriched

    Session record attached: the full conversation, the prompt that triggered the upload, the project, and the user.

Outcome

No data left the endpoint. The audit record contains the full transcript, the held action, and the approver’s decision.

What you get

What Neo Adds to Claude Enterprise

Neo · InventoryClaude

Claude Code1,148

Claude Desktop2,906

Cowork agents214

MCP servers87

Visibility

Unified Claude Inventory

Claude usage on every endpoint, alongside the agents, extensions, and MCP servers Neo already tracks.

WhenClaude agent

reads secretsBlock

exports over 10 MBHold

pushes to mainHold

reads repoAllow

Control

Real-Time Policy on Claude Actions

Allow, hold, or block tool calls, file access, and data egress at execution time. Policies can be written in natural language.

Neo · Action traceVerified

01 HumanFinance analyst

02 SessionClaude Desktop

03 AgentCowork

04 Actionupload .csv

Audit

Immutable Audit Trail

Sensor events and Compliance API records merged into one trail per session, exportable to your SIEM or GRC tooling.

Console panels show example data.

Get started

Configure the Compliance API Connector

If the Neo Sensor is already deployed, Claude activity on managed endpoints is covered today. The connector adds organization-level records from the Compliance API.

What you'll need

  • Required first A Claude Enterprise plan Session transcripts and content records come from the Compliance API on Claude Enterprise, and the API must be enabled for your parent organization.
  • A Compliance Access Key created in claude.ai by your Primary Owner, with read access to activities, user data, and org data
  • The Neo Sensor on your endpoints or deploy it in minutes, with first scan to full inventory in under 15 minutes

  1. Add the Claude Enterprise Connector

    In the Neo console, open Integrations → Claude Enterprise and start a new connector.

  2. Paste Your Compliance Access Key

    Neo begins ingesting session transcripts, chats, and admin events, and correlates them with existing sensor events.

  3. Enable the Claude Policy Pack

    Default policies include:

    • BlockClaude Code reads of credentials and keys
    • HoldCowork exports over 10 MB to unapproved tools
    • FlagPII or contracts in chats from unmanaged devices
The bigger picture

Retrospective Audit and Runtime Enforcement

Anthropic's Compliance API gives security teams governed access to Claude Enterprise activity, which many organizations require before approving a company-wide rollout. Audit data is retrospective by nature. By the time an event appears in the API, the action has completed.

Claude Code and Cowork execute commands and move data autonomously. Neo applies policy at the endpoint at execution time, and uses Compliance API data to complete the audit record for every session.

Talk to an expert

Align Claude with Your Enterprise Security Strategy

Schedule a technical session with our team. We'll inventory Claude usage across your endpoints, review coverage gaps, and configure the Compliance API connector.

Get a Demo Talk to the Team