Anthropic Claude Cowork'ning mahalliy virtual mashinasida endpointni aniqlash va javob berish (EDR) sensorlarini ishga tushirish uchun beta qo'llab-quvvatlashni ishga tushirdi.
Bu yangilik korporativ xavfsizlik jamoalariga an'anaviy xostga asoslangan monitoring aniqlay olmaydigan AI agent faoliyatini ko'rish imkonini beradi. Yangi funksiya Team va Enterprise mijozlari uchun Windows va macOS'da Claude Desktop bilan mos keladi.
Anthropic'ning joylashtirish hujjatlariga ko'ra, integratsiya Amazon Bedrock, Google Cloud Vertex AI yoki Microsoft Foundry bilan ulangan Claude Desktop bilan ham ishlaydi. U aniq ko'rinish bo'shlig'iga qaratilgan: Cowork kompyuterning mavjud EDR sensori ko'rinishidan tashqarida, ajratilgan VM ichida shell buyruqlari va kodni bajaradi.
Cowork VM ishga tushganda, Claude Desktop sozlangan sotuvchi sensor paketini muhitga nusxalaydi. U uni o'sha sotuvchining tasdiqlangan imzo kaliti bilan tekshiradi. Yaroqli paket sotuvchining o'rnatish skriptini ishga tushiradi, bu VM har bir ishga tushishida ko'pi bilan bir marta bajariladi. Sozlamalarsiz hech narsa o'rnatilmaydi.
VM odatda foydalanuvchi Cowork'ni ochganda ishga tushadi va Claude yopilguncha yoki foydalanuvchi tizimdan chiqquncha faol qoladi. O'rnatilgandan so'ng, sensor o'z sotuvchisining bulutiga ulanadi va himoyachilar allaqachon foydalanadigan xavfsizlik konsoliga faoliyatni xabar qiladi.
Hozirda tasdiqlangan sotuvchilar qatoriga CrowdStrike, Evoke Security, Neo, Palo Alto Networks, Pluto Security, SentinelOne va Tanium kiradi. Claude Desktop tasdiqlangan sotuvchi imzosiga ega bo'lmagan paketlarni rad etadi.
Bu endpoint darajasidagi telemetriya kengroq Claude Compliance API monitoringini to'ldiradi, bu korporativ tekshiruvlar uchun qo'llab-quvvatlanadigan suhbatlar, fayllar, transkriptlar va ma'muriy hodisalarni ochib beradi.
Administratorlarga Claude Desktop 4.4212.0 yoki undan yuqori versiya kerak. Windows joylashtirishlari maxsus .msix qurilmasini, Windows 10 yoki 11, apparat virtualizatsiyasini va Virtual Machine Platform funksiyasini talab qiladi. Sozlash macOS mobil qurilma boshqaruvi yoki Group Policy yoki Intune kabi vositalar orqali Windows registr siyosat boshqaruvini talab qiladi.
Integratsiya faqat foydalanuvchining kompyuterida mahalliy ishlaydigan VM'ni qamrab oladi. Sensorlar Anthropic tomonidan xost qilingan bulut sessiyalarida o'rnatilmaydi, bu Cowork veb va mobil ish oqimlari bo'ylab kengayishi bilan muhim farqdir.
Xavfsizlik jamoalari ma'lumotlar bilan ishlashni ham hisobga olishlari kerak. Sensorlar so'rovlar, fayllar, javoblar va boshqa VM mazmunini tekshirishi, so'ngra ma'lumotni o'z sotuvchisiga Cowork'ning tarmoq ruxsat ro'yxatidan tashqarida uzatishi mumkin. Anthropic bu ma'lumotni qabul qilmasligini va nazorat qilmasligini aytadi. Bu AI agent ish oqimlari jurnallar, buyruq argumentlari yoki transkriptlar orqali ma'lumotlarni ochib beradigan joylarda tekshirishni talab qiladi.
Boshqaruv sozlamalarini olib tashlash kelajakdagi paket bajarilishini to'xtatadi, lekin mavjud sensorni o'chirmaydi. Paket imzolari keyingi sensor yuklab olgan yangilanishlarni istisno qiladi va ikki yil ichida muddati tugaydi, bu qayta imzolangan paketlarni talab qiladi.
Tashkilotlar joylashtirishdan oldin va Claude yoki sensor yangilanishlaridan keyin integratsiyalarni sinovdan o'tkazishlari kerak. Anthropic beta davrida qo'shimcha integratsiya to'lovini olmaydi, garchi sotuvchilar alohida to'lov olishlari mumkin.
SOC'ingizga hodisalarni tez to'xtatish uchun ogohlantirish kontekstini bering.16K SOC'dan tahdid razvedkasini integratsiya qiling.
Anthropic has launched beta support for running endpoint detection and response (EDR) sensors within Claude Cowork’s local virtual machine.
This enhancement gives enterprise security teams visibility into AI agent activity that traditional host-based monitoring cannot detect. The new feature is compatible with Claude Desktop on both Windows and macOS for Team and Enterprise customers.
According to Anthropic’s deployment documentation, the integration also works with Claude Desktop connected to Amazon Bedrock, Google Cloud Vertex AI, or Microsoft Foundry. It targets a specific visibility gap: Cowork executes shell commands and code inside an isolated VM, beyond the view of the computer’s existing EDR sensor.
Whenever the Cowork VM starts, Claude Desktop copies the configured vendor sensor package into the environment. It verifies its signature against that vendor’s approved signing key. A valid package triggers the vendor’s installation script, which runs at most once per VM startup. Without configuration, nothing is installed.
The VM typically starts when a user opens Cowork and remains active until Claude quits or the user signs out. Once installed, the sensor connects to its vendor’s cloud and reports activity to the security console defenders already use.
Approved vendors currently include CrowdStrike, Evoke Security, Neo, Palo Alto Networks, Pluto Security, SentinelOne, and Tanium. Claude Desktop rejects packages lacking an approved vendor signature.
This endpoint-level telemetry complements broader Claude Compliance API monitoring, which exposes supported conversations, files, transcripts, and administrative events for enterprise investigations.
Administrators need Claude Desktop version 4.4212.0 or later. Windows deployments specifically require the .msix build, Windows 10 or 11, hardware virtualization, and the Virtual Machine Platform feature. Configuration requires macOS mobile device management or Windows registry policy management through tools such as Group Policy or Intune.
The integration covers only the VM running locally on the user’s computer. Sensors cannot be installed in Anthropic-hosted cloud sessions, an important distinction as Cowork expands across web and mobile workflows.
Security teams must also account for data handling. Sensors can inspect prompts, files, responses, and other VM content, then transmit information to their vendor outside Cowork’s network allowlist. Anthropic says it neither receives nor controls that data. This warrants scrutiny where AI agent workflows expose credentials through logs, command arguments, or transcripts.
Removing management settings stops future package execution but does not uninstall an existing sensor. Package signatures exclude subsequent sensor-downloaded updates and expire within two years, requiring re-signed packages.
Organizations must test integrations before deployment and after Claude or sensor updates. Anthropic charges no additional integration fee during beta, although vendors may charge separately.
Give your SOC the alert context to stops incidents quickly.Integrate Threat Intel from 16K SOCs.