Graduate Anthropic.Activity rules & Standard.OTX.MaliciousIndicator out of experimental + create Anthropic pack

[alessandrarizzo]

Summary

• Graduate all 17 Anthropic.Activity.* rules out of Status: Experimental based on last week's noise/match review
• Create packs/anthropic.yml (PantherManaged.Anthropic) bundling all 17 rules plus the panther_anthropic_helpers global.
• Graduate Standard.OTX.MaliciousIndicator out of experimental and add it to PantherManaged.UniversalDetections in packs/standard_ruleset.yml.

Test plan

• pipenv run panther_analysis_tool test --path rules/anthropic_rules/ — 17/17 pass
• pipenv run panther_analysis_tool test --filter RuleID=Standard.OTX.MaliciousIndicator — pass
• pipenv run panther_analysis_tool zip --path packs/anthropic.yml — pack references resolve cleanly
• make lint — clean (10.00/10)

[cursor]

PR Summary

Medium Risk
Graduating high-severity Anthropic and universal OTX detections increases production alerting surface without changing match logic—main risk is operational noise and triage load.

Overview
Promotes 17 Anthropic.Activity detections and Standard.OTX.MaliciousIndicator out of experimental by removing Status: Experimental from their YAML—no rule logic or severity changes in the diff.

Adds packs/anthropic.yml (PantherManaged.Anthropic) so those Anthropic rules ship together with panther_anthropic_helpers and panther_base_helpers.

Updates packs/standard_ruleset.yml (PantherManaged.UniversalDetections) to include the OTX rule and panther_otx_helpers alongside the existing universal detections pack.

^{Reviewed by Cursor Bugbot for commit badcb4c. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 3fc9d57. Configure here.}