Panther rules: onepass

AnalysisType: scheduled_query
Description: Looks for OnePassword Logins from IP Addresses that aren''t seen in CrowdStrike''s AIP List.
Enabled: false
SnowflakeQuery: |
  SELECT *
  FROM panther_logs.public.onepassword_signinattempt
  WHERE category = 'success'
    AND client:ip_address LIKE '%.%.%.%'
    AND p_occurs_since('1 hour')
    AND client:platform_name NOT LIKE '%iPhone'
    AND type = 'credentials_ok'
    AND client:app_name != '1Password SCIM Bridge'
    AND client:ip_address NOT IN
      (
          SELECT distinct aip
          FROM panther_logs.public.crowdstrike_aidmaster
          WHERE p_occurs_since('3 days')
      )

DatabricksQuery: |
  SELECT *
  FROM panther_logs.onepassword_signinattempt
  WHERE category = 'success'
    AND client:ip_address LIKE '%.%.%.%'
    AND p_occurs_since('1 hour')
    AND client:platform_name NOT LIKE '%iPhone'
    AND type = 'credentials_ok'
    AND client:app_name != '1Password SCIM Bridge'
    AND client:ip_address NOT IN
      (
          SELECT DISTINCT aip
          FROM panther_logs.crowdstrike_aidmaster
          WHERE p_occurs_since('3 days')
      )
QueryName: "1Password Login From CrowdStrike Unmanaged Device Query"
Schedule:
  RateMinutes: 60
  TimeoutMinutes: 1
Tags:
  - Multi-Table Query

# This file is the part of the Crowdstrike FDREvent migration, and it's the equivalent of
# https://github.com/panther-labs/panther-analysis/blob/b61db1ecf3967c5f6a44c1782f8891fd5f54384d/queries/onepassword_queries/onepass_login_from_crowdstrike_unmanaged_device.yml
#
AnalysisType: scheduled_query
Description: Looks for OnePassword Logins from IP Addresses that aren''t seen in CrowdStrike''s AIP List. (crowdstrike_fdrevent table)
Enabled: false
SnowflakeQuery: |
  SELECT *
  FROM panther_logs.public.onepassword_signinattempt
  WHERE category = 'success'
    AND client:ip_address LIKE '%.%.%.%'
    AND p_occurs_since('1 days')
    AND client:platform_name NOT LIKE '%iPhone'
    AND type = 'credentials_ok'
    AND client:app_name != '1Password SCIM Bridge'
    AND client:ip_address NOT IN
      (
          SELECT distinct aip
          FROM panther_logs.public.crowdstrike_fdrevent
          WHERE p_occurs_since('3 days') AND panther_logs.public.crowdstrike_fdrevent.fdr_event_type = 'aid_master'
      )

DatabricksQuery: |
  SELECT *
  FROM panther_logs.onepassword_signinattempt
  WHERE category = 'success'
    AND client:ip_address LIKE '%.%.%.%'
    AND p_occurs_since('1 days')
    AND client:platform_name NOT LIKE '%iPhone'
    AND type = 'credentials_ok'
    AND client:app_name != '1Password SCIM Bridge'
    AND client:ip_address NOT IN
      (
          SELECT DISTINCT aip
          FROM panther_logs.crowdstrike_fdrevent
          WHERE p_occurs_since('3 days') AND panther_logs.crowdstrike_fdrevent.fdr_event_type = 'aid_master'
      )
QueryName: "1Password Login From CrowdStrike Unmanaged Device Query (crowdstrike_fdrevent table)"
Schedule:
  RateMinutes: 1440
  TimeoutMinutes: 1
Tags:
  - Multi-Table Query