Panther rules: duo

def rule(event):
    # Return True to match the log event and trigger an alert.
    return event.get("action", "") == "integration_skey_view"


def title(event):
    # If no 'dedup' function is defined, the return value of
    # this method will act as deduplication string.
    return (
        f"'Duo: [{event.get('username', '<NO_USER_FOUND>')}] viewed "
        f"the Secret Key for Application [{event.get('object', '<NO_OBJECT_FOUND>')}]"
    )

AnalysisType: rule
Description: An administrator viewed a Secret Key for an Application Integration
DisplayName: "Duo Admin App Integration Secret Key Viewed"
Enabled: true
Filename: duo_admin_app_integration_secret_key_viewed.py
Reference: https://duo.com/docs/adminapi
Runbook: The security of your Duo application is tied to the security of your secret key (skey). Secure it as you would any sensitive credential. Don't share it with unauthorized individuals or email it to anyone under any circumstances!
Severity: Medium
DedupPeriodMinutes: 60
LogTypes:
  - Duo.Administrator
RuleID: "Duo.Admin.App.Integration.Secret.Key.Viewed"
Threshold: 1

def rule(event):
    # Return True to match the log event and trigger an alert.
    return event.get("action", "") == "bypass_create"


def title(event):
    # If no 'dedup' function is defined, the return value of
    # this method will act as deduplication string.
    return (
        f"Duo: [{event.get('username', '<NO_USER_FOUND>')}] created "
        f"a MFA bypass code for [{event.get('object', '<NO_OBJECT_FOUND>')}]"
    )

AnalysisType: rule
Description: A Duo administrator created an MFA bypass code for an application.
DisplayName: "Duo Admin Bypass Code Created"
Enabled: true
Filename: duo_admin_bypass_code_created.py
Runbook: Confirm this was authorized and necessary behavior.
Reference: https://duo.com/docs/administration-users#generating-a-bypass-code
Severity: Medium
DedupPeriodMinutes: 60
LogTypes:
  - Duo.Administrator
RuleID: "Duo.Admin.Bypass.Code.Created"
Threshold: 1

def rule(event):
    # Return True to match the log event and trigger an alert.
    return event.get("action", "") == "bypass_view"


def title(event):
    # If no 'dedup' function is defined, the return value
    # of this method will act as deduplication string.
    return (
        f"Duo: [{event.get('username', '<NO_USER_FOUND>')}] viewed "
        f"an MFA bypass code for [{event.get('object', '<NO_OBJECT_FOUND>')}]."
    )

AnalysisType: rule
Description: An administrator viewed the MFA bypass code for a user.
DisplayName: "Duo Admin Bypass Code Viewed"
Enabled: true
Filename: duo_admin_bypass_code_viewed.py
Reference: https://duo.com/docs/adminapi
Runbook: Confirm this behavior is authorized. The security of your Duo application is tied to the security of your secret key (skey). Secure it as you would any sensitive credential. You should not share it with unauthorized individuals or email it to anyone under any circumstances!
Severity: Medium
DedupPeriodMinutes: 60
LogTypes:
  - Duo.Administrator
RuleID: "Duo.Admin.Bypass.Code.Viewed"
Threshold: 1

from panther_duo_helpers import deserialize_administrator_log_event_description, duo_alert_context


def rule(event):
    return event.get("action") == "admin_create"


def title(event):
    event_description = deserialize_administrator_log_event_description(event)
    return (
        f"Duo: [{event.get('username', '<username_not_found>')}] "
        "created a new admin account: "
        f"[{event_description.get('name', '<name_not_found>')}] "
        f"[{event_description.get('email', '<email_not_found>')}]."
    )


def alert_context(event):
    return duo_alert_context(event)

AnalysisType: rule
Description: "A new Duo Administrator was created. "
DisplayName: "Duo Admin Create Admin"
Enabled: true
Filename: duo_admin_create_admin.py
Reference: https://duo.com/docs/administration-admins#add-an-administrator
Severity: High
DedupPeriodMinutes: 60
LogTypes:
  - Duo.Administrator
RuleID: "Duo.Admin.Create.Admin"
Threshold: 1

import json


def rule(event):
    # Return True to match the log event and trigger an alert.
    return event.get("action", "") == "admin_lockout"


def title(event):
    # If no 'dedup' function is defined, the return value
    # of this method will act as deduplication string.
    try:
        desc = json.loads(event.get("description", {}))
        message = desc.get("message", "<NO_MESSAGE_FOUND>")[:-1]
    except ValueError:
        message = "Invalid Json"
    return (
        f"Duo Admin [{event.get('username', '<NO_USER_FOUND>')}] is "
        f"locked out. Reason: [{message}]."
    )

AnalysisType: rule
Description: Alert when a duo administrator is locked out of their account.
DisplayName: "Duo Admin Lockout"
Enabled: true
Filename: duo_admin_lockout.py
Reference: https://duo.com/docs/adminapi
Severity: Medium
DedupPeriodMinutes: 60
LogTypes:
  - Duo.Administrator
RuleID: "Duo.Admin.Lockout"
Threshold: 1

from panther_duo_helpers import deserialize_administrator_log_event_description


def rule(event):
    event_description = deserialize_administrator_log_event_description(event)

    return (
        event.get("action") == "admin_2fa_error"
        and "fraudulent" in event_description.get("error", "").lower()
    )


def title(event):
    event_description = deserialize_administrator_log_event_description(event)
    admin_username = event.get("username", "Unknown")
    user_email = event_description.get("email", "Unknown")

    return f"Duo Admin [{admin_username}] denied due to an anomalous 2FA push for [{user_email}]"


def alert_context(event):
    event_description = deserialize_administrator_log_event_description(event)

    return {
        "reason": event_description.get("error", ""),
        "reporting_admin": event.get("username", ""),
        "user": event_description.get("email", ""),
        "ip_address": event_description.get("ip_address", ""),
    }

AnalysisType: rule
Filename: duo_admin_marked_push_fraudulent.py
RuleID: "DUO.Admin.Action.MarkedFraudulent"
DisplayName: "Duo Admin Marked Push Fraudulent"
Enabled: true
DedupPeriodMinutes: 15
LogTypes:
  - Duo.Administrator
Tags:
  - Duo
Severity: Medium
Description: A Duo push was marked fraudulent by an admin.
Reference: https://duo.com/docs/adminapi#administrator-logs
Runbook: Follow up with the administrator to determine reasoning for marking fraud.

from panther_duo_helpers import duo_alert_context


def rule(event):
    return event.get("action") == "update_admin_factor_restrictions"


def title(event):
    return "Duo Admin MFA Restrictions Updated " f"by [{event.get('username','<user_not_found>')}]"


def alert_context(event):
    return duo_alert_context(event)

AnalysisType: rule
Description: Detects changes to allowed MFA factors administrators can use to log into the admin panel.
DisplayName: "Duo Admin MFA Restrictions Updated"
Enabled: true
Filename: duo_admin_mfa_restrictions_updated.py
Reference: https://duo.com/docs/essentials-overview
Severity: Medium
DedupPeriodMinutes: 60
LogTypes:
  - Duo.Administrator
RuleID: "Duo.Admin.MFA.Restrictions.Updated"
Threshold: 1

from panther_duo_helpers import deserialize_administrator_log_event_description, duo_alert_context


def rule(event):
    if event.get("action") == "integration_create":
        description = deserialize_administrator_log_event_description(event)
        integration_type = description.get("type")
        return integration_type == "Admin API"
    return False


def title(event):
    return (
        f"Duo: [{event.get('username', '<username_not_found>')}] "
        "created a new Admin API integration "
        f"to [{event.get('object', '<object_not_found>')}]"
    )


def alert_context(event):
    return duo_alert_context(event)

AnalysisType: rule
Description: Identifies creation of new Admin API integrations for Duo.
DisplayName: "Duo Admin New Admin API App Integration"
Enabled: true
Filename: duo_admin_new_admin_api_app_integration.py
Reference: https://duo.com/docs/adminapi#overview
Severity: High
DedupPeriodMinutes: 60
LogTypes:
  - Duo.Administrator
RuleID: "Duo.Admin.New.Admin.API.App.Integration"
Threshold: 1

from panther_duo_helpers import duo_alert_context


def rule(event):
    return event.get("action") == "policy_update"


def title(event):
    return (
        f"Duo: [{event.get('username', '<username_not_found>')}] "
        f"updated [{event.get('object', 'Duo Policy')}]."
    )


def alert_context(event):
    return duo_alert_context(event)

AnalysisType: rule
Description: A Duo Administrator updated a Policy, which governs how users authenticate.
DisplayName: "Duo Admin Policy Updated"
Enabled: true
Filename: duo_admin_policy_updated.py
Reference: https://duo.com/docs/policy#authenticators-policy-settings
Severity: Medium
DedupPeriodMinutes: 60
LogTypes:
  - Duo.Administrator
RuleID: "Duo.Admin.Policy.Updated"
Threshold: 1

from panther_duo_helpers import deserialize_administrator_log_event_description, duo_alert_context


def rule(event):
    if event.get("action") == "admin_single_sign_on_update":
        description = deserialize_administrator_log_event_description(event)
        enforcement_status = description.get("enforcement_status", "required")
        return enforcement_status != "required"
    return False


def title(event):
    description = deserialize_administrator_log_event_description(event)
    return (
        f"Duo: [{event.get('username', '<username_not_found>')}] "
        "changed SAML authentication requirements for Administrators "
        f"to [{description.get('enforcement_status', '<enforcement_status_not_found>')}]"
    )


def alert_context(event):
    return duo_alert_context(event)

AnalysisType: rule
Description: Detects when SAML Authentication for Administrators is marked as Disabled or Optional.
DisplayName: "Duo Admin SSO SAML Requirement Disabled"
Enabled: true
Filename: duo_admin_sso_saml_requirement_disabled.py
Reference: https://duo.com/docs/sso#saml:~:text=Modify%20Authentication%20Sources
Severity: Medium
DedupPeriodMinutes: 60
LogTypes:
  - Duo.Administrator
RuleID: "Duo.Admin.SSO.SAML.Requirement.Disabled"
Threshold: 1

from panther_duo_helpers import deserialize_administrator_log_event_description, duo_alert_context


def rule(event):
    if event.get("action") == "user_update":
        description = deserialize_administrator_log_event_description(event)
        if "status" in description:
            return description.get("status") == "Bypass"
    return False


def title(event):
    return (
        f"Duo: [{event.get('username', '<username_not_found>')}] "
        f"updated account [{event.get('object', '<object_not_found>')}] "
        "to not require two-factor authentication."
    )


def alert_context(event):
    return duo_alert_context(event)

AnalysisType: rule
Description: An Administrator enabled a user to authenticate without MFA.
DisplayName: "Duo Admin User MFA Bypass Enabled"
Enabled: true
Filename: duo_admin_user_mfa_bypass_enabled.py
Reference: https://duo.com/docs/policy#authentication-policy
Severity: Medium
DedupPeriodMinutes: 60
LogTypes:
  - Duo.Administrator
RuleID: "Duo.Admin.User.MFA.Bypass.Enabled"
Threshold: 1

def rule(event):
    return event.get("result") == "fraud"


def title(event):
    user = event.deep_get("user", "name", default="Unknown")
    return f"A Duo action was marked as fraudulent by [{user}]"


def alert_context(event):
    return {
        "factor": event.get("factor"),
        "reason": event.get("reason"),
        "user": event.deep_get("user", "name", default=""),
        "os": event.deep_get("access_device", "os", default=""),
        "ip_access": event.deep_get("access_device", "ip", default=""),
        "ip_auth": event.deep_get("auth_device", "ip", default=""),
        "application": event.deep_get("application", "name", default=""),
    }

AnalysisType: rule
Filename: duo_user_action_fraudulent.py
RuleID: "DUO.User.Action.Fraudulent"
DisplayName: "Duo User Action Reported as Fraudulent"
Enabled: true
DedupPeriodMinutes: 15
LogTypes:
  - Duo.Authentication
Tags:
  - Duo
Severity: Medium
Description: >
  Alert when a user reports a Duo action as fraudulent.
Reference: https://duo.com/docs/adminapi#authentication-logs
Runbook: Follow up with the user to confirm.

def rule(event):
    return event.get("reason") == "anomalous_push" and event.get("result") == "denied"


def title(event):
    user = event.deep_get("user", "name", default="Unknown")
    return f"Duo Auth denied due to an anomalous 2FA push for [{user}]"


def alert_context(event):
    return {
        "factor": event.get("factor"),
        "reason": event.get("reason"),
        "user": event.deep_get("user", "name", default=""),
        "os": event.deep_get("access_device", "os", default=""),
        "ip_access": event.deep_get("access_device", "ip", default=""),
        "ip_auth": event.deep_get("auth_device", "ip", default=""),
        "application": event.deep_get("application", "name", default=""),
    }

AnalysisType: rule
Filename: duo_user_anomalous_push.py
RuleID: "DUO.User.Denied.AnomalousPush"
DisplayName: "Duo User Auth Denied For Anomalous Push"
Enabled: true
DedupPeriodMinutes: 15
LogTypes:
  - Duo.Authentication
Tags:
  - Duo
Severity: Medium
Description: >
  A Duo authentication was denied due to an anomalous 2FA push.
Reference: https://duo.com/docs/adminapi#authentication-logs
Runbook: Follow up with the user to confirm they intended several pushes in quick succession.

def rule(event):
    return event.get("reason") == "bypass_user" and event.get("result") == "success"


def title(event):
    user = event.deep_get("user", "name", default="Unknown")
    return f"Bypass code for Duo User [{user}] used"


def alert_context(event):
    return {
        "factor": event.get("factor"),
        "reason": event.get("reason"),
        "user": event.deep_get("user", "name", default=""),
        "os": event.deep_get("access_device", "os", default=""),
        "ip_access": event.deep_get("access_device", "ip", default=""),
        "ip_auth": event.deep_get("auth_device", "ip", default=""),
        "application": event.deep_get("application", "name", default=""),
    }

AnalysisType: rule
Filename: duo_user_bypass_code_used.py
RuleID: "DUO.User.BypassCode.Used"
DisplayName: "Duo User Bypass Code Used"
Enabled: true
DedupPeriodMinutes: 5
LogTypes:
  - Duo.Authentication
Tags:
  - Duo
Severity: Low
Description: A Duo user's bypass code was used to authenticate
Reference: https://duo.com/docs/adminapi#authentication-logs
Runbook: Follow up with the user to confirm they used the bypass code themselves.

def rule(event):
    endpoint_reasons = [
        "endpoint_is_not_in_management_system",
        "endpoint_failed_google_verification",
        "endpoint_is_not_trusted",
        "could_not_determine_if_endpoint_was_trusted",
        "invalid_device",
    ]
    return event.get("reason", "") in endpoint_reasons


def title(event):
    user = event.deep_get("user", "name", default="Unknown")
    reason = event.get("reason", "Unknown")
    return f"Duo User [{user}] encountered suspicious endpoint issue [{reason}]"


def alert_context(event):
    return {
        "factor": event.get("factor"),
        "reason": event.get("reason"),
        "user": event.deep_get("user", "name", default=""),
        "os": event.deep_get("access_device", "os", default=""),
        "ip_access": event.deep_get("access_device", "ip", default=""),
        "ip_auth": event.deep_get("auth_device", "ip", default=""),
        "application": event.deep_get("application", "name", default=""),
    }

AnalysisType: rule
Filename: duo_user_endpoint_failure_multi.py
RuleID: "DUO.User.Endpoint.Failure"
DisplayName: "Duo User Denied For Endpoint Error"
Enabled: true
DedupPeriodMinutes: 15
LogTypes:
  - Duo.Authentication
Tags:
  - Duo
Severity: Medium
Description: A Duo user's authentication was denied due to a suspicious error on the endpoint
Reference: https://duo.com/docs/adminapi#authentication-logs
Runbook: Follow up with the endpoint owner to see status. Follow up with user to verify attempts.