Detection rules › Panther

Panther rules: axonius

Rule	Severity
Axonius API Key Reset	`low`
Axonius External User Added	`low`
Axonius login from Tor IP	`medium`
Axonius Too Many Failed Logins	`medium`
Axonius Webhook Created	`low`

Axonius API Key Reset

Severity: low
Log types: Axonius.Activity
Tags: Axonius
Source: github.com/panther-labs/panther-analysis

Detects an Axonius API Key Reset

Detection logic

def rule(event):
    action = event.deep_get("event", "action", default="")
    if action == "AuditAction.ResetApiKey":
        return True
    return False


def title(event):
    username = event.deep_get("event", "user", default="")
    return f"[Axonius] API Key Reset for {username} Detected"

Rule specification

AnalysisType: rule
Filename: axonius_resetapikey.py
RuleID: Axonius.ResetApiKey
DisplayName: Axonius API Key Reset
Enabled: true
LogTypes:
  - Axonius.Activity
Tags:
  - Axonius
Severity: Low
Description: Detects an Axonius API Key Reset
Runbook: Review the actions taken, check credentials/service user used and escalate.

Stages and Predicates

Fires on Axonius.Activity events when the condition below holds.

Condition

event.action is AuditAction.ResetApiKey

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`event.action`	eq	`AuditAction.ResetApiKey`	`field:"EventType" kind:eq value:"AuditAction.ResetApiKey"`

Output fields

Fields the rule emits when it matches, drawn from the rule's alert_context.

Field	Source
`user`	`event.user`

Response runbook

Review the actions taken, check credentials/service user used and escalate.

Worked example

A sample event from the rule's unit tests that triggers a match.

Sample Test Event

{
  "event": {
    "action": "AuditAction.ResetApiKey",
    "category": "AuditCategory.Settings",
    "params": {},
    "type": "user",
    "user": "boss@axonius.com"
  },
  "source": "axonius",
  "time": 1752699243.486779
}

Axonius External User Added

Severity: low
Log types: Axonius.Activity
Tags: Axonius
Source: github.com/panther-labs/panther-analysis

Detects when an external user is added in Axonius

Detection logic

def rule(event):
    action = event.deep_get("event", "action", default="")
    category = event.deep_get("event", "category", default="")
    if action == "AuditAction.AddExternalUser" and category == "AuditCategory.UserManagement":
        return True
    return False


def title(event):
    username = event.deep_get("event", "params", "user_name", default="")
    source = event.deep_get("event", "params", "source", default="")
    return f"[Axonius] External User {username} added from {source}"


def alert_context(event):
    username = event.deep_get("event", "params", "user_name", default="")
    source = event.deep_get("event", "params", "source", default="")
    context = {
        "username": username,
        "source": source,
    }
    return context

Rule specification

AnalysisType: rule
Filename: axonius_add_external_user.py
RuleID: Axonius.AddExternalUser
DisplayName: Axonius External User Added
Enabled: true
LogTypes:
  - Axonius.Activity
Tags:
  - Axonius
Severity: Low
Description: Detects when an external user is added in Axonius
Runbook: Review if the external user is authorized

Stages and Predicates

Fires on Axonius.Activity events when all of the conditions below hold.

Condition

event.action is AuditAction.AddExternalUser
event.category is AuditCategory.UserManagement

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`event.action`	eq	`AuditAction.AddExternalUser`	`field:"EventType" kind:eq value:"AuditAction.AddExternalUser"`
`event.category`	eq	`AuditCategory.UserManagement`	`field:"event.category" kind:eq value:"AuditCategory.UserManagement"`

Output fields

Fields the rule emits when it matches, drawn from the rule's alert_context.

Field	Source
`username`	`event.params.user_name`
`source`	`event.params.source`

Response runbook

Review if the external user is authorized

Worked example

A sample event from the rule's unit tests that triggers a match.

Sample Test Event

{
  "event": {
    "action": "AuditAction.AddExternalUser",
    "category": "AuditCategory.UserManagement",
    "params": {
      "source": "SAM-XYX",
      "user_name": "external-user@axonius.com"
    },
    "type": "info"
  },
  "source": "axonius",
  "time": 1747795144.253623
}

Axonius login from Tor IP

Severity: medium
Log types: Axonius.Activity
Tags: Axonius, Tor
Source: github.com/panther-labs/panther-analysis

Detects an Axonius login from Tor IP address

Detection logic

from panther_tor_helpers import TorExitNodes


def rule(event):
    action = event.deep_get("event", "action", default="")
    status = event.deep_get("event", "params", "status", default="")
    if status == "successful" and action == "AuditAction.LoginFrom":
        return TorExitNodes(event).has_exit_nodes()
    return False


def title(event):
    username = event.deep_get("event", "user", default="")
    return f"[Axonius] Login from {username} Detected on a TOR IP Address"


def alert_context(event):
    username = event.deep_get("event", "user", default="")
    ip_address = event.deep_get("event", "params", "ip", default="")
    action = event.deep_get("event", "action", default="")
    status = event.deep_get("event", "params", "status", default="")

    context = {
        "username": username,
        "ip_address": ip_address,
        "action": action,
        "status": status,
    }
    return context

Rule specification

AnalysisType: rule
Filename: axonius_tor_login.py
RuleID: Axonius.TorLogin
DisplayName: Axonius login from Tor IP
Enabled: true
LogTypes:
  - Axonius.Activity
Tags:
  - Axonius
  - Tor
Severity: Medium
Description: Detects an Axonius login from Tor IP address
Runbook: Review the actions taken, check credentials/service user used and escalate.

Stages and Predicates

Fires on Axonius.Activity events when all of the conditions below hold.

Condition

event.params.status is successful
event.action is AuditAction.LoginFrom

This rule also runs imperative logic the parser cannot express as a filter. The conditions above are the structured part it could extract.

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`event.action`	eq	`AuditAction.LoginFrom`	`field:"EventType" kind:eq value:"AuditAction.LoginFrom"`
`event.params.status`	eq	`successful`	`field:"event.params.status" kind:eq value:"successful"`

Output fields

Fields the rule emits when it matches, drawn from the rule's alert_context.

Field	Source
`username`	`event.user`
`ip_address`	`event.params.ip`
`action`	`event.action`
`status`	`event.params.status`

Response runbook

Review the actions taken, check credentials/service user used and escalate.

Worked example

A sample event from the rule's unit tests that triggers a match.

Sample Test Event

{
  "event": {
    "action": "AuditAction.LoginFrom",
    "category": "AuditCategory.UserSession",
    "params": {
      "ip": "1.2.3.4",
      "status": "successful"
    },
    "type": "user",
    "user": "denethor@lotr.com"
  },
  "p_enrichment": {
    "tor_exit_nodes": true
  },
  "source": "axonius",
  "time": 1752690986.344609
}

Axonius Too Many Failed Logins

Severity: medium
Group by: event.user
Log types: Axonius.Activity
Tags: Axonius
Source: github.com/panther-labs/panther-analysis

Detects too many failed Axonius login attempts, which may indicate a brute-force attack

Detection logic

def rule(event):
    action = event.deep_get("event", "action", default="")
    status = event.deep_get("event", "params", "status", default="")
    username = event.deep_get("event", "user", default="")
    return status != "successful" and action == "AuditAction.LoginFrom" and bool(username)


def dedup(event):
    return event.deep_get("event", "user", default="<UNKNOWN_USER>")


def title(event):
    username = event.deep_get("event", "user", default="")
    return f"[Axonius] Too many failed Login from {username}"


def alert_context(event):
    username = event.deep_get("event", "user", default="")
    ip_address = event.deep_get("event", "params", "ip", default="")
    action = event.deep_get("event", "action", default="")
    status = event.deep_get("event", "params", "status", default="")

    context = {
        "username": username,
        "ip_address": ip_address,
        "action": action,
        "status": status,
    }
    return context

Rule specification

AnalysisType: rule
Filename: axonius_too_many_failed_logins.py
RuleID: Axonius.TooManyFailedLogins
DisplayName: Axonius Too Many Failed Logins
Enabled: true
LogTypes:
  - Axonius.Activity
Tags:
  - Axonius
Severity: Medium
Threshold: 5
DedupPeriodMinutes: 5
Description: Detects too many failed Axonius login attempts, which may indicate a brute-force attack
Runbook: Review the actions taken, check credentials/service user used and escalate.

Stages and Predicates

Fires on Axonius.Activity events when all of the conditions below hold.

Condition

event.params.status is not successful
event.action is AuditAction.LoginFrom
event.user is present

Alert cadence: alerts after 5 matches within 5m

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`event.action`	eq	`AuditAction.LoginFrom`	`field:"EventType" kind:eq value:"AuditAction.LoginFrom"`
`event.params.status`	ne	`successful`	`field:"event.params.status" kind:ne value:"successful"`
`event.user`	is_not_null	(no value, null check)	`field:"event.user" kind:is_not_null`

Output fields

Fields the rule emits when it matches, drawn from the rule's alert_context.

Field	Source
`username`	`event.user`
`ip_address`	`event.params.ip`
`action`	`event.action`
`status`	`event.params.status`

Response runbook

Review the actions taken, check credentials/service user used and escalate.

Worked example

A sample event from the rule's unit tests that triggers a match.

Sample Test Event

{
  "event": {
    "action": "AuditAction.LoginFrom",
    "category": "AuditCategory.UserSession",
    "params": {
      "ip": "1.2.3.4",
      "status": "failure"
    },
    "type": "user",
    "user": "denethor@lotr.com"
  },
  "source": "axonius",
  "time": 1752690986.344609
}

Axonius Webhook Created

Severity: low
Log types: Axonius.Activity
Tags: Axonius
Source: github.com/panther-labs/panther-analysis

Detects when an Axonius Webhook is Created

Detection logic

def rule(event):
    action = event.deep_get("event", "action", default="")
    category = event.deep_get("event", "category", default="")
    if action == "AuditAction.Put" and category == "AuditCategory.WebhookManagement":
        return True
    return False


def title(event):
    username = event.deep_get("event", "user", default="")
    return f"[Axonius] API Key Reset for {username} Detected"


def alert_context(event):
    username = event.deep_get("event", "user", default="")
    config_id = event.deep_get("event", "params", "config_id", default="")
    vendor_name = event.deep_get("event", "params", "vendor_name", default="")
    event_type = event.deep_get("event", "type", default="")

    context = {
        "username": username,
        "config_id": config_id,
        "vendor_name": vendor_name,
        "type": event_type,
    }
    return context

Rule specification

AnalysisType: rule
Filename: axonius_webhook_created.py
RuleID: Axonius.WebhookCreated
DisplayName: Axonius Webhook Created
Enabled: true
LogTypes:
  - Axonius.Activity
Tags:
  - Axonius
Severity: Low
Description: Detects when an Axonius Webhook is Created
Runbook: Review if the webhook is approved and appropriate

Stages and Predicates

Fires on Axonius.Activity events when all of the conditions below hold.

Condition

event.action is AuditAction.Put
event.category is AuditCategory.WebhookManagement

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`event.action`	eq	`AuditAction.Put`	`field:"EventType" kind:eq value:"AuditAction.Put"`
`event.category`	eq	`AuditCategory.WebhookManagement`	`field:"event.category" kind:eq value:"AuditCategory.WebhookManagement"`

Output fields

Fields the rule emits when it matches, drawn from the rule's alert_context.

Field	Source
`username`	`event.user`
`config_id`	`event.params.config_id`
`vendor_name`	`event.params.vendor_name`
`type`	`event.type`

Response runbook

Review if the webhook is approved and appropriate

Worked example

A sample event from the rule's unit tests that triggers a match.

Sample Test Event

{
  "event": {
    "action": "AuditAction.Put",
    "category": "AuditCategory.WebhookManagement",
    "params": {
      "config_id": "66db3fc88a93f66a4da0f084",
      "vendor_name": "Okta"
    },
    "type": "user",
    "user": "admin@axonius.com"
  },
  "source": "axonius",
  "time": 1745944321.285849
}