Panther rules: docusign

from panther_docusign_helpers import docusign_alert_context


def rule(event):
    return event.get("event") == "envelope-corrected"


def title(event):
    envelope_id = event.deep_get("data", "envelopeId", default="Unknown")
    sender_email = event.deep_get("data", "sender", "email", default="Unknown")
    return f"DocuSign envelope [{envelope_id}] corrected by [{sender_email}]"


def alert_context(event):
    return docusign_alert_context(event)

AnalysisType: rule
Filename: docusign_envelope_corrected.py
RuleID: "Docusign.Connect.EnvelopeCorrected"
DisplayName: "DocuSign Envelope Corrected"
Enabled: true
LogTypes:
  - Docusign.Connect
Tags:
  - DocuSign
  - Envelope
  - Tampering
Severity: Low
Description: >
  Detects when a DocuSign envelope is corrected after being sent. Frequent corrections could indicate
  document tampering attempts, process abuse, or suspicious modification of legal documents. Monitor
  for patterns of correction behavior that may indicate fraud.
Runbook: |
  1. Review the envelope contents and what was corrected
  2. Verify if the correction was legitimate business process
  3. Check for patterns of envelope corrections by the same user
  4. Review the original and corrected document versions
  5. Consider investigating other envelopes sent by the same sender
  6. Verify recipient authentication for corrected envelopes
Reference: https://developer.docusign.com/docs/connect/events/
SummaryAttributes:
  - data.envelopeId
  - data.senderEmail
  - data.email

from panther_docusign_helpers import docusign_alert_context


def rule(event):
    return event.get("event") == "envelope-voided"


def title(event):
    envelope_id = event.deep_get("data", "envelopeId", default="Unknown")
    sender_email = event.deep_get("data", "sender", "email", default="Unknown")
    return f"DocuSign envelope [{envelope_id}] voided by [{sender_email}]"


def alert_context(event):
    return docusign_alert_context(event) | {
        "voided_reason": event.deep_get("data", "envelopeSummary", "voidedReason"),
        "voided_date_time": event.deep_get("data", "envelopeSummary", "voidedDateTime"),
    }

AnalysisType: rule
Filename: docusign_envelope_voided.py
RuleID: "Docusign.Connect.EnvelopeVoided"
DisplayName: "DocuSign Envelope Voided"
Enabled: true
LogTypes:
  - Docusign.Connect
Tags:
  - DocuSign
  - Envelope
  - Fraud
Severity: Medium
Description: >
  Detects when a DocuSign envelope is voided. Frequent voiding of envelopes could indicate fraudulent
  activity, document tampering attempts, or process abuse. Monitor for patterns of voiding behavior.
Runbook: |
  1. Review the envelope contents and recipients
  2. Verify if the voiding was legitimate or suspicious
  3. Check for patterns of envelope voiding by the same user
  4. Review the termination reason for additional context
  5. Consider investigating other envelopes sent by the same sender
Reference: https://developer.docusign.com/docs/connect/events/
SummaryAttributes:
  - data.envelopeId
  - data.senderEmail
  - data.terminationReason

from panther_docusign_helpers import docusign_alert_context, get_recipients


def rule(event):
    return event.get("event") == "recipient-authentication-failure"


def title(event):
    recipients = get_recipients(event)
    recipient = (
        [
            recipient
            for recipient in recipients
            if recipient.get("recipientId") == event.deep_get("data", "recipientId")
        ][0]
        if recipients
        else {}
    )
    recipient_email = recipient.get("email", "Unknown")
    envelope_id = event.deep_get("data", "envelopeId", default="Unknown")
    return (
        f"DocuSign recipient authentication failure for "
        f"[{recipient_email}] on envelope [{envelope_id}]"
    )


def alert_context(event):
    return docusign_alert_context(event)

AnalysisType: rule
Filename: docusign_recipient_authentication_failure.py
RuleID: "Docusign.Connect.RecipientAuthenticationFailure"
DisplayName: "DocuSign Recipient Authentication Failure"
Enabled: true
LogTypes:
  - Docusign.Connect
Tags:
  - DocuSign
  - Authentication
Severity: Medium
Threshold: 5
DedupPeriodMinutes: 60
Description: >
  Detects when a DocuSign recipient fails authentication while attempting to access an envelope.
  This could indicate attempted unauthorized access to sensitive documents or credential compromise.
Runbook: |
  1. Review the recipient's email and authentication method used
  2. Check if this is a legitimate user having authentication issues
  3. Verify if the envelope contains sensitive information
  4. Consider blocking the recipient if suspicious activity is detected
  5. Review other envelopes sent to the same recipient
Reference: https://developer.docusign.com/docs/connect/events/
SummaryAttributes:
  - data.email
  - data.envelopeId
  - data.authenticationStatus

from panther_docusign_helpers import docusign_alert_context, get_recipients


def rule(event):
    return event.get("event") == "recipient-declined"


def title(event):
    recipients = get_recipients(event)
    recipient = (
        [
            recipient
            for recipient in recipients
            if recipient.get("recipientId") == event.deep_get("data", "recipientId")
        ][0]
        if recipients
        else {}
    )
    recipient_email = recipient.get("email", "Unknown")
    envelope_id = event.deep_get("data", "envelopeId", default="Unknown")
    return f"DocuSign recipient [{recipient_email}] declined envelope [{envelope_id}]"


def alert_context(event):
    return docusign_alert_context(event)

AnalysisType: rule
Filename: docusign_recipient_declined.py
RuleID: "Docusign.Connect.RecipientDeclined"
DisplayName: "DocuSign Recipient Declined Envelope"
Enabled: true
LogTypes:
  - Docusign.Connect
Tags:
  - DocuSign
  - Recipient
  - Declined
  - Business Process
Severity: Low
Description: >
  Detects when a DocuSign recipient declines to sign an envelope. While often legitimate business
  activity, frequent declines or patterns of declines may indicate issues with document validity,
  recipient concerns about authenticity, or potential fraud attempts.
Runbook: |
  1. Review the envelope contents and recipients
  2. Check if the decline reason was provided
  3. Verify if this is expected business behavior
  4. Monitor for patterns of declines for the same envelope or sender
  5. Consider reaching out to the recipient for clarification
  6. Review if the envelope was sent to the correct recipient
Reference: https://developer.docusign.com/docs/connect/events/
SummaryAttributes:
  - data.email
  - data.envelopeId
  - data.senderEmail

from panther_docusign_helpers import docusign_alert_context


def rule(event):
    template_events = ["template-created", "template-modified", "template-deleted"]
    return event.get("event") in template_events


def title(event):
    event_type = event.get("event", "template-modified").split("-")[1]
    template_id = event.deep_get("data", "templateId", default="Unknown")
    user_id = event.deep_get("data", "userId", default="Unknown")

    action = event_type.replace("template-", "").replace("-", " ").title()
    return f"DocuSign template {action.lower()}: {template_id} by user {user_id}"


def severity(event):
    event_type = event.get("event")
    if event_type == "template-deleted":
        return "DEFAULT"
    if event_type == "template-modified":
        return "LOW"
    return "INFO"


def alert_context(event):
    return docusign_alert_context(event)

AnalysisType: rule
Filename: docusign_template_management.py
RuleID: "Docusign.Connect.TemplateManagement"
DisplayName: "DocuSign Template Management Activity"
Enabled: true
LogTypes:
  - Docusign.Connect
Tags:
  - DocuSign
  - Template
  - Administrative
Severity: Medium
Description: >
  Detects DocuSign template management activities including creation, modification, and deletion.
  Template changes can affect business processes and should be monitored for unauthorized modifications.
  Deletions are particularly critical as they may indicate data destruction or process disruption.
Runbook: |
  1. Review the template changes and verify they are authorized
  2. Check if the user has appropriate permissions for template management
  3. For deletions, verify if this was intentional and documented
  4. For modifications, review what specific changes were made
  5. Monitor for patterns of excessive template changes
  6. Ensure proper approval workflow was followed for template changes
Reference: https://developer.docusign.com/docs/connect/events/
SummaryAttributes:
  - event
  - data.templateId
  - data.userId
  - data.email