Panther rules: dropbox

def rule(event):
    return event.deep_get("event_type", "_tag", default="") == "sign_in_as_session_start"


def title(event):
    actor = event.deep_get("actor", "admin", "email", default="<ACTOR_NOT_FOUND>")
    target = event.deep_get("context", "email", default="<TARGET_NOT_FOUND>")
    return f"Dropbox: Admin [{actor}] started a sign-in-as session as user [{target}]."

AnalysisType: rule
Description: "Alerts when an admin starts a sign-in-as session."
DisplayName: "Dropbox Admin sign-in-as Session"
Enabled: true
Filename: dropbox_admin_sign_in_as_session.py
Reference: https://help.dropbox.com/security/sign-in-as-user
Severity: Medium
DedupPeriodMinutes: 60
LogTypes:
  - Dropbox.TeamEvent
RuleID: "Dropbox.Admin.sign.in.as.Session"
Threshold: 1

def rule(event):
    return "Transferred ownership " in event.deep_get("event_type", "description", default="")


def title(event):
    actor = event.deep_get("actor", "user", "email", default="<EMAIL_NOT_FOUND>")
    previous_owner = event.deep_get(
        "details", "previous_owner_email", default="<PREVIOUS_OWNER_NOT_FOUND>"
    )
    new_owner = event.deep_get("details", "new_owner_email", default="<NEW_OWNER_NOT_FOUND>")
    assets = event.get("assets", [{}])
    asset = [a.get("display_name", "<ASSET_NOT_FOUND>") for a in assets]
    return (
        f"Dropbox: [{actor}] transferred ownership of [{asset}]"
        f"from [{previous_owner}] to [{new_owner}]."
    )


def severity(event):
    new_owner_domain = event.deep_get("details", "new_owner_email", default="@").split("@")[-1]
    previous_owner_domain = event.deep_get("details", "previous_owner_email", default="@").split(
        "@"
    )[-1]

    if new_owner_domain != previous_owner_domain:
        return "DEFAULT"
    return "LOW"

AnalysisType: rule
Description: "Dropbox ownership of a document or folder has been transferred."
DisplayName: "Dropbox Document/Folder Ownership Transfer"
Enabled: true
Filename: dropbox_ownership_transfer.py
Reference: https://help.dropbox.com/share/owner
Severity: Medium
DedupPeriodMinutes: 60
LogTypes:
  - Dropbox.TeamEvent
RuleID: "Dropbox.Ownership.Transfer"
Threshold: 1

def rule(event):
    actor_domain = event.deep_get("actor", "user", "email", default="@").split("@")[-1]

    if event.deep_get("event_type", "_tag", default="") == "shared_content_add_member":
        participants = event.get("participants", [{}])
        for participant in participants:
            email = participant.get("user", {}).get("email", "@")
            if email.split("@")[-1] != actor_domain:
                return True
    return False


def title(event):
    actor = event.deep_get("actor", "user", "email", default="<ACTOR_NOT_FOUND>")
    actor_domain = event.deep_get("actor", "user", "email", default="@").split("@")[-1]
    assets = [e.get("display_name", "") for e in event.get("assets", [{}])]
    participants = event.get("participants", [{}])
    external_participants = []
    for participant in participants:
        email = participant.get("user", {}).get("email", "")
        if email.split("@")[-1] != actor_domain:
            external_participants.append(email)
    return f"Dropbox: [{actor}] shared [{assets}] with external user [{external_participants}]."


def alert_context(event):
    actor_domain = event.deep_get("actor", "user", "email", default="@").split("@")[-1]
    external_participants = []
    participants = event.get("participants", [{}])
    for participant in participants:
        email = participant.get("user", {}).get("email", "")
        if email.split("@")[-1] != actor_domain:
            external_participants.append(email)
    return {"external_participants": external_participants}

AnalysisType: rule
Description: Dropbox item shared externally
DisplayName: "Dropbox External Share"
Enabled: true
Filename: dropbox_external_share.py
Reference: https://help.dropbox.com/share/share-outside-dropbox
Severity: Low
DedupPeriodMinutes: 60
LogTypes:
  - Dropbox.TeamEvent
RuleID: "Dropbox.External.Share"
Threshold: 1

def rule(event):
    return all(
        [
            event.deep_get("event_type", "_tag", default="") == "app_link_team",
            event.deep_get("event_type", "description", default="") == "Linked app for team",
        ]
    )


def severity(event):
    # Anything involving non-team members should be High
    if event.get("involve_non_team_member", False):
        return "High"
    return "Low"


def get_actor_type():
    return (
        # Admin who performed the action
        "admin",
        # Anonymous actor
        "anonymous",
        # Application that performed the action
        "app",
        # Action performed by Dropbox
        "dropbox",
        # Action performed by reseller
        "reseller",
        # User who performed the action
        "user",
    )


def title(event):
    # This will be one of the types returned by get_actor_type;
    # find the intersection and use that for the key
    actor_key = set(tuple(event.get("actor", {}).keys())).intersection(get_actor_type())
    if len(actor_key) == 1:
        display_name = event.deep_get(
            "actor", tuple(actor_key)[0], "display_name", default="<Unknown>"
        )
    # Explicitly use "<Unknown>" if we find any length of keys != 1
    else:
        display_name = "<Unknown>"
    return f"Dropbox Team Member Linked App by [{display_name}]"


def user_details(event):
    details = {}
    for actor_key, actor_value in event.get("actor", {}).items():
        if actor_key == "_tag":
            continue
        for user_key, user_info in actor_value.items():
            if user_key in ("_tag", "display_name"):
                continue
            details[user_key] = user_info
    return details


def alert_context(event):
    additional_user_details = user_details(event)
    return {
        "additional_user_details": additional_user_details,
        "app_display_name": event.deep_get(
            "details", "app_info", "display_name", default="<Unknown app display name>"
        ),
        "ip_address": event.deep_get(
            "origin", "geo_location", "ip_address", default="<Unknown IP address>"
        ),
        "request_id": event.deep_get(
            "origin", "access_method", "request_id", default="<Unknown request ID>"
        ),
    }

AnalysisType: rule
Description: An application was linked to your Dropbox Account
DisplayName: "Dropbox Linked Team Application Added"
Enabled: true
Filename: dropbox_linked_team_application_added.py
Reference: https://help.dropbox.com/integrations/app-integrations
Runbook: >
  Ensure that the application is valid and not malicious. Verify that this is expected. If not, determine other actions taken by this user recently and reach out to the user.
  If the event involved a non-team member, consider disabling the user's access while investigating.
Severity: Low
Tags:
  - dropbox
DedupPeriodMinutes: 60
LogTypes:
  - Dropbox.TeamEvent
RuleID: "Dropbox.Linked.Team.Application.Added"
Threshold: 1

def rule(_):
    return True


def title(event):
    return (
        f"Dropbox: [{event.get('user', '<user_not_found>')}] "
        f"has deleted [{event.get('delete_count', '<count_not_found>')}] "
        "documents from Dropbox."
    )


def alert_context(event):
    return event.to_dict()

AnalysisType: scheduled_rule
Description: Detects when a dropbox user deletes many documents.
DisplayName: "Dropbox Many Deletes"
Enabled: false
Status: Deprecated
Filename: dropbox_many_deletes.py
Reference: https://help.dropbox.com/delete-restore/delete-files
Severity: Medium
DedupPeriodMinutes: 60
RuleID: "Dropbox.Many.Deletes"
Threshold: 1
ScheduledQueries:
  - Dropbox Many Deletes
Tags:
  - Configuration Required

AnalysisType: scheduled_query
Description: Dropbox Many Deletes
Enabled: false
SnowflakeQuery: |-
  SELECT
    actor:user:email AS user,
    ARRAY_AGG( DISTINCT assets[0]:path:contextual) AS deleted_files,
    ARRAY_SIZE(deleted_files) as delete_count,
    TIME_SLICE(p_event_time, 60, 'minute') as t_s
  FROM panther_logs.public.dropbox_teamevent
  WHERE p_occurs_since('1 day')
    AND event_type:_tag = 'file_delete'
  GROUP BY actor:user:email, t_s
  HAVING delete_count > 2
  ORDER BY delete_count DESC

DatabricksQuery: |-
  SELECT
    actor:user:email AS user,
    COLLECT_SET(assets[0]:path:contextual) AS deleted_files,
    SIZE(COLLECT_SET(assets[0]:path:contextual)) AS delete_count,
    DATE_TRUNC('hour', p_event_time) AS t_s
  FROM panther_logs.dropbox_teamevent
  WHERE p_occurs_since('1 day')
    AND event_type:_tag = 'file_delete'
  GROUP BY actor:user:email, DATE_TRUNC('hour', p_event_time)
  HAVING delete_count > 2
  ORDER BY delete_count DESC
QueryName: "Dropbox Many Deletes"
Schedule:
  RateMinutes: 1440
  TimeoutMinutes: 3

def rule(event):
    return event.deep_get("event_type", "_tag", default="") == "file_delete"


def title(event):
    user = event.deep_get("actor", "user", "email", default="<UNKNOWN_USER>")
    return f"Dropbox: User [{user}] deleted many files"


def dedup(event):
    return event.deep_get("actor", "user", "email", default="")


def unique(event):
    assets = event.get("assets", [])
    if assets:
        return assets[0].get("path", {}).get("contextual") or None
    return None


def severity(event):
    if event.get("involve_non_team_member", False):
        return "HIGH"
    return "DEFAULT"


def alert_context(event):
    assets = event.get("assets", [])
    file_path = assets[0].get("path", {}).get("contextual", "") if assets else ""
    return {
        "user": event.deep_get("actor", "user", "email"),
        "file_path": file_path,
        "involve_non_team_member": event.get("involve_non_team_member"),
        "ip_address": event.deep_get("origin", "geo_location", "ip_address"),
    }

AnalysisType: rule
Filename: dropbox_many_deletes.py
RuleID: "Dropbox.BulkDeletes"
DisplayName: "Dropbox Many Deletes"
Status: Experimental
Enabled: false
Severity: Medium
DedupPeriodMinutes: 60
Threshold: 11
LogTypes:
  - Dropbox.TeamEvent
Description: >
  Detects when a Dropbox user deletes more than 10 distinct files within 60 minutes.
  This may indicate accidental or malicious bulk deletion of team files.
  The threshold should be tuned to your environment.
Reference: https://help.dropbox.com/delete-restore/delete-files
Reports:
  MITRE ATT&CK:
    - TA0040:T1485
Tags:
  - Dropbox
  - Impact
  - Data Destruction
Runbook: |
  1. Query Dropbox.TeamEvent for all file_delete events by actor:user:email in the 2 hours around this alert to identify the full list of assets[0]:path:contextual values deleted
  2. Check involve_non_team_member and origin:geo_location:ip_address to determine if the deletions originated from an unexpected user or location, and assess whether the deleted files were shared with external parties
  3. Search for other suspicious activity by this user in the past 24 hours, including bulk downloads prior to deletion, external sharing events, or login anomalies

def rule(_):
    return True


def title(event):
    return (
        f"Dropbox: [{event.get('user', '<user_not_found>')}] "
        f"has downloaded [{event.get('download_count', '<count_not_found>')}] "
        "documents from Dropbox."
    )


def alert_context(event):
    return event.to_dict()

AnalysisType: scheduled_rule
Description: Detects when a dropbox user downloads many documents.
DisplayName: "Dropbox Many Downloads"
Enabled: false
Status: Deprecated
Filename: dropbox_many_downloads.py
Reference: https://learn.dropbox.com/video-library/upload-and-download-files
Severity: Medium
DedupPeriodMinutes: 60
RuleID: "Dropbox.Many.Downloads"
Threshold: 1
ScheduledQueries:
  - Dropbox Many Downloads
Tags:
  - Configuration Required

AnalysisType: scheduled_query
Description: Dropbox Many Downloads
Enabled: false
SnowflakeQuery: |-
  SELECT
    actor:user:email AS user,
    ARRAY_AGG( DISTINCT assets[0]:path:contextual) AS downloaded_files,
    ARRAY_SIZE(downloaded_files) as download_count,
    TIME_SLICE(p_event_time, 60, 'minute') as t_s
  FROM panther_logs.public.dropbox_teamevent
  WHERE p_occurs_since('1 day')
    AND event_type:_tag = 'file_download'
  GROUP BY actor:user:email, t_s
  HAVING download_count > 10
  ORDER BY download_count DESC

DatabricksQuery: |-
  SELECT
    actor:user:email AS user,
    COLLECT_SET(assets[0]:path:contextual) AS downloaded_files,
    SIZE(COLLECT_SET(assets[0]:path:contextual)) AS download_count,
    DATE_TRUNC('hour', p_event_time) AS t_s
  FROM panther_logs.dropbox_teamevent
  WHERE p_occurs_since('1 day')
    AND event_type:_tag = 'file_download'
  GROUP BY actor:user:email, DATE_TRUNC('hour', p_event_time)
  HAVING download_count > 10
  ORDER BY download_count DESC
QueryName: "Dropbox Many Downloads"
Schedule:
  RateMinutes: 1440
  TimeoutMinutes: 3

def rule(event):
    return event.deep_get("event_type", "_tag", default="") == "file_download"


def title(event):
    user = event.deep_get("actor", "user", "email", default="<UNKNOWN_USER>")
    return f"Dropbox: User [{user}] downloaded many files"


def dedup(event):
    return event.deep_get("actor", "user", "email", default="")


def unique(event):
    assets = event.get("assets", [])
    if assets:
        return assets[0].get("path", {}).get("contextual") or None
    return None


def severity(event):
    if event.get("involve_non_team_member", False):
        return "HIGH"
    return "DEFAULT"


def alert_context(event):
    assets = event.get("assets", [])
    file_path = assets[0].get("path", {}).get("contextual", "") if assets else ""
    return {
        "user": event.deep_get("actor", "user", "email"),
        "file_path": file_path,
        "involve_non_team_member": event.get("involve_non_team_member"),
        "ip_address": event.deep_get("origin", "geo_location", "ip_address"),
    }

AnalysisType: rule
Filename: dropbox_many_downloads.py
RuleID: "Dropbox.BulkDownloads"
DisplayName: "Dropbox Many Downloads"
Status: Experimental
Enabled: false
Severity: Medium
DedupPeriodMinutes: 60
Threshold: 11
LogTypes:
  - Dropbox.TeamEvent
Description: >
  Detects when a Dropbox user downloads more than 10 distinct files within 60 minutes.
  This may indicate data exfiltration or unauthorized bulk access to team files.
  The threshold should be tuned to your environment.
Reference: https://learn.dropbox.com/video-library/upload-and-download-files
Reports:
  MITRE ATT&CK:
    - TA0010:T1567
Tags:
  - Dropbox
  - Exfiltration
Runbook: |
  1. Query Dropbox.TeamEvent for all file_download events by actor:user:email in the 2 hours around this alert to identify the full list of assets[0]:path:contextual values downloaded
  2. Check involve_non_team_member and the origin:geo_location:ip_address to determine if the downloads originated from an external user or an unexpected location
  3. Search for other suspicious activity by this user in the past 24 hours, including external sharing events, ownership transfers, or logins from new devices or locations

def rule(event):
    return all(
        [
            event.deep_get("details", ".tag", default="") == "tfa_change_status_details",
            event.deep_get("details", "new_value", ".tag") == "disabled",
        ]
    )


def title(event):
    actor = event.deep_get("actor", "user", "email", default="<EMAIL_NOT_FOUND>")
    target = event.deep_get("context", "email", default="<TARGET_NOT_FOUND>")
    return f"Dropbox: [{actor}] disabled 2FA for [{target}]."

AnalysisType: rule
Description: Dropbox user has disabled 2fa login
DisplayName: "Dropbox User Disabled 2FA"
Enabled: true
Filename: dropbox_user_disabled_2fa.py
Reference: https://help.dropbox.com/account-access/enable-two-step-verification
Severity: Low
DedupPeriodMinutes: 60
LogTypes:
  - Dropbox.TeamEvent
RuleID: "Dropbox.User.Disabled.2FA"
Threshold: 1