Panther rules: netskope

def rule(event):
    if event.get("is_netskope_personnel") is True:
        return True
    return False


def title(event):
    user = event.get("user", "<USER_NOT_FOUND>")
    audit_log_event = event.get("audit_log_event", "<EVENT_NOT_FOUND>")
    return f"Action [{audit_log_event}] performed by Netskope personnel [{user}]"

AnalysisType: rule
RuleID: "Netskope.NetskopePersonnelActivity"
DisplayName: "Action Performed by Netskope Personnel"
Enabled: true
Filename: netskope_personnel_action.py
LogTypes:
  - Netskope.Audit
Tags:
  - Netskope
  - Supply Chain Compromise
Reports:
  MITRE ATT&CK:
    - TA0001:T1195
Severity: Medium
Description: An action was performed by Netskope personnel.
DedupPeriodMinutes: 60
Threshold: 1
Runbook: Action taken by Netskope Personnel.  Validate that this action was authorized.
Reference: https://docs.netskope.com/en/netskope-help/admin-console/administration/audit-log/#filters-1

def rule(event):
    if event.get("audit_log_event") == "Admin logged out because of successive login failures":
        return True
    return False


def title(event):
    user = event.get("user", "<USER_NOT_FOUND>")
    return f"Admin [{user}] was logged out because of successive login failures"

AnalysisType: rule
RuleID: "Netskope.AdminLoggedOutLoginFailures"
DisplayName: "Admin logged out because of successive login failures"
Enabled: true
Filename: netskope_admin_logged_out.py
LogTypes:
  - Netskope.Audit
Tags:
  - Netskope
  - Brute Force
Reports:
  MITRE ATT&CK:
    - TA0006:T1110
Severity: Medium
Description: An admin was logged out because of successive login failures.
DedupPeriodMinutes: 60
Threshold: 1
Runbook: An admin was logged out because of successive login failures.  This could indicate brute force activity against this account.
Reference: https://docs.netskope.com/en/netskope-help/admin-console/administration/audit-log/

ADMIN_USER_CHANGE_EVENTS = [
    "Created new admin",
    "Added SSO Admin",
    "Edited SSO Admin Record",
    "Created new support admin",
    "Edit admin record",
    "Deleted admin",
    "Enabled admin",
    "Disabled admin",
    "Unlocked admin",
    "Updated admin settings",
    "Deleted Netskope SSO admin",
]


def rule(event):
    if event.get("audit_log_event") in ADMIN_USER_CHANGE_EVENTS:
        return True
    return False


def title(event):
    user = event.get("user", "<USER_NOT_FOUND>")
    audit_log_event = event.get("audit_log_event", "<EVENT_NOT_FOUND>")
    return f"User [{user}] performed [{audit_log_event}]"


def severity(event):
    audit_log_event = event.get("audit_log_event", "no_data").lower()
    if "create" in audit_log_event or "add" in audit_log_event or "delete" in audit_log_event:
        return "CRITICAL"
    return "HIGH"

AnalysisType: rule
RuleID: "Netskope.AdminUserChange"
DisplayName: "An administrator account was created, deleted, or modified."
Enabled: true
Filename: netskope_admin_user_change.py
LogTypes:
  - Netskope.Audit
Tags:
  - Netskope
  - Account Manipulation
Reports:
  MITRE ATT&CK:
    - TA0004:T1098
Severity: High
Reference: https://docs.netskope.com/en/netskope-help/admin-console/administration/managing-administrators/
Description: An administrator account was created, deleted, or modified.
DedupPeriodMinutes: 60
Threshold: 1
Runbook: An administrator account was created, deleted, or modified.  Validate that this activity is expected and authorized.

def rule(event):
    audit_log_event = event.get("audit_log_event")
    if audit_log_event and "Delete" in audit_log_event:
        return True
    return False


def title(event):
    user = event.get("user", "<USER_NOT_FOUND>")
    return f"[{user}] deleted many objects in a short time"

AnalysisType: rule
RuleID: "Netskope.ManyDeletes"
DisplayName: "Netskope Many Objects Deleted"
Enabled: true
Filename: netskope_many_deletes.py
LogTypes:
  - Netskope.Audit
Tags:
  - Netskope
  - Configuration Required # configure threshold for your environment
  - Data Destruction
Reports:
  MITRE ATT&CK:
    - TA0040:T1485
Severity: High
Description: A user deleted a large number of objects in a short period of time.
DedupPeriodMinutes: 60
Threshold: 10
Runbook: A user deleted a large number of objects in a short period of time.  Validate that this activity is expected and authorized.
Reference: https://docs.netskope.com/en/netskope-help/admin-console/administration/audit-log/

def rule(event):
    data_values = event.deep_walk("supporting_data", "data_values")
    if data_values and data_values[0] == 403:
        return True
    return False


def title(event):
    user = event.get("user", "<USER_NOT_FOUND>")
    return f"Many unauthorized API calls from user [{user}]"

AnalysisType: rule
RuleID: "Netskope.UnauthorizedAPICalls"
DisplayName: "Netskope Many Unauthorized API Calls"
Enabled: true
Filename: netskope_unauthorized_api_calls.py
LogTypes:
  - Netskope.Audit
Tags:
  - Netskope
  - Configuration Required # configure threshold for your environment
  - Brute Force
Reports:
  MITRE ATT&CK:
    - TA0006:T1110
Severity: High
Description: Many unauthorized API calls were observed for a user in a short period of time.
DedupPeriodMinutes: 60
Threshold: 10
Runbook: An account is making many unauthorized API calls.  This could indicate brute force activity, or expired service account credentials.
Reference: https://docs.netskope.com/en/netskope-help/data-security/netskope-private-access/private-access-rest-apis/