Box Shield Suspicious Alert Triggered

AnalysisType: rule
Filename: box_suspicious_login_or_session.py
RuleID: "Box.Shield.Suspicious.Alert"
DisplayName: "Box Shield Suspicious Alert Triggered"
Enabled: true
LogTypes:
  - Box.Event
Tags:
  - Box
  - Initial Access:Valid Accounts
Reports:
  MITRE ATT&CK:
    - TA0001:T1078
Severity: High
Description: >
  A user login event or session event was tagged as medium to high severity by Box Shield.
Reference: https://developer.box.com/guides/events/shield-alert-events/
Runbook: >
  Investigate whether this was triggered by an expected user event.
SummaryAttributes:
  - event_type
  - ip_address
Tests:
  - Name: Regular Event
    ExpectedResult: false
    Log:
      {
        "type": "event",
        "additional_details": '{"key": "value"}',
        "created_by":
          {
            "id": "12345678",
            "type": "user",
            "login": "ceo@example",
            "name": "Bob Cat",
          },
        "event_type": "DELETE",
      }
  - Name: Suspicious Login Event
    ExpectedResult: true
    Log:
      {
        "type": "event",
        "additional_details": '{"shield_alert":{"rule_category":"Suspicious Locations","risk_score":60,"user":{"email":"bob@example"}}}',
        "created_by":
          {
            "id": "12345678",
            "type": "user",
            "login": "bob@example",
            "name": "Bob Cat",
          },
        "event_type": "SHIELD_ALERT",
        "source": { "id": "12345678", "type": "user" },
      }
  - Name: Suspicious Session Event
    ExpectedResult: true
    Log:
      {
        "type": "event",
        "additional_details": '{"shield_alert":{"rule_category":"Suspicious Sessions","risk_score":70,"alert_summary":{"description":"First time in prior month user connected from ip 1.2.3.4."},"user":{"email":"bob@example"}}}',
        "created_by":
          {
            "id": "12345678",
            "type": "user",
            "login": "bob@example",
            "name": "Bob Cat",
          },
        "event_type": "SHIELD_ALERT",
        "source": { "id": "12345678", "type": "user" },
      }
  - Name: Suspicious Session Event - Low Risk
    ExpectedResult: false
    Log:
      {
        "type": "event",
        "additional_details": '{"shield_alert":{"rule_category":"Suspicious Sessions","risk_score":10,"alert_summary":{"description":"First time in prior month user connected from ip 1.2.3.4."},"user":{"email":"bob@example"}}}',
        "created_by":
          {
            "id": "12345678",
            "type": "user",
            "login": "bob@example",
            "name": "Bob Cat",
          },
        "event_type": "SHIELD_ALERT",
        "source": { "id": "12345678", "type": "user" },
      }