Panther rules: onepassword

def rule(_):
    return True


def title(event):
    return (
        "1Password Login for "
        f"[{event.deep_get('target_user', 'email', default = '<email_not_found>')}]"
        " from unmanaged IP Address."
    )

AnalysisType: scheduled_rule
Description: Detects 1Password Logins from IP addresses not found in CrowdStrike''s AIP list. May indicate unmanaged device being used, or faulty CrowdStrike Sensor.
DisplayName: "1Password Login From CrowdStrike Unmanaged Device"
Enabled: false
Filename: onepassword_login_from_crowdstrike_unmanaged_device.py
Reference: https://www.crowdstrike.com/wp-content/uploads/2023/05/crowdstrike-falcon-device-control-data-sheet.pdf
Severity: Medium
DedupPeriodMinutes: 60
RuleID: "OnePassword.Login.From.CrowdStrike.Unmanaged.Device"
Threshold: 1
ScheduledQueries:
  - 1Password Login From CrowdStrike Unmanaged Device Query
Tags:
  - Multi-Table Query

"""
This rule requires the use of the Lookup Table feature currently in Beta in Panther, 1Password
logs reference items by their UUID without human-friendly titles. The instructions to create a
lookup table to do this translation can be found at :

 https://docs.runpanther.io/guides/using-lookup-tables-1password-uuids

The steps detailed in that document are required for this rule to function as intended.
"""

# Add the human-readable names of 1Password items you want to monitor
SENSITIVE_ITEM_WATCHLIST = ["demo_item"]


def rule(event):
    return (
        event.deep_get("p_enrichment", "1Password Translation", "item_uuid", "title")
        in SENSITIVE_ITEM_WATCHLIST
    )


def title(event):
    return f"A Sensitive 1Password Item was Accessed by user {event.deep_get('user', 'name')}"


def alert_context(event):
    context = {
        "user": event.deep_get("user", "name"),
        "item_name": event.deep_get("p_enrichment", "1Password Translation", "item_uuid", "title"),
        "client": event.deep_get("client", "app_name"),
        "ip_address": event.udm("source_ip"),
        "event_time": event.get("timestamp"),
    }

    return context

AnalysisType: rule
Filename: onepassword_lut_sensitive_item_access.py
RuleID: "OnePassword.Lut.Sensitive.Item"
DedupPeriodMinutes: 30
DisplayName: "BETA - Sensitive 1Password Item Accessed"
Enabled: false
LogTypes:
  - OnePassword.ItemUsage
Reference: https://support.1password.com/1password-com-items/
Severity: Low
Description: Alerts when a user defined list of sensitive items in 1Password is accessed
SummaryAttributes:
  - p_any_ip_addresses
  - p_any_emails
Tags:
  - Configuration Required
  - 1Password
  - Lookup Table
  - Credential Access:Unsecured Credentials
Status: Experimental
Reports:
  MITRE ATT&CK:
    - TA0006:T1552

"""
This rule detects access to high sensitivity items in your 1Password account. 1Password references
these items by their UUID so the SENSITIVE_ITEM_WATCHLIST below allows for the mapping of UUID to
meaningful name.

There is an alternative method for creating this rule that uses Panther's lookup table feature,
(currently in beta). That rule can be found in the 1Password detection pack with the name
BETA - Sensitive 1Password Item Accessed (onepassword_lut_sensitive_item_access.py)
"""

SENSITIVE_ITEM_WATCHLIST = {"ecd1d435c26440dc930ddfbbef201a11": "demo_item"}


def rule(event):
    return event.get("item_uuid") in SENSITIVE_ITEM_WATCHLIST.keys()


def title(event):
    return f"A Sensitive 1Password Item was Accessed by user {event.deep_get('user', 'name')}"


def alert_context(event):
    context = {
        "user": event.deep_get("user", "name"),
        "item_name": event.deep_get("p_enrichment", "1Password Translation", "item_uuid", "title"),
        "client": event.deep_get("client", "app_name"),
        "ip_address": event.udm("source_ip"),
        "event_time": event.get("timestamp"),
    }

    return context

AnalysisType: rule
Filename: onepassword_sensitive_item_access.py
RuleID: "OnePassword.Sensitive.Item"
DedupPeriodMinutes: 30
DisplayName: "Configuration Required - Sensitive 1Password Item Accessed"
Enabled: false
LogTypes:
  - OnePassword.ItemUsage
Reference: https://support.1password.com/1password-com-items/
Severity: Low
Description: Alerts when a user defined list of sensitive items in 1Password is accessed
SummaryAttributes:
  - p_any_ip_addresses
  - p_any_emails
Tags:
  - Configuration Required
  - 1Password
  - Credential Access:Unsecured Credentials
Reports:
  MITRE ATT&CK:
    - TA0006:T1552

"""
This rule detects unusual or unauthorized clients connecting to your 1Password account.
In order to get a baseline of what clients are being used in your environment run the following
query in Data Explorer:

select distinct client:app_name from panther_logs.public.onepassword_signinattempt

The client_allowlist variable is a collection of standard 1Password clients.
If this differs from your orginization's needs this rule can be edited to suit your environment
"""


def rule(event):
    client_allowlist = [
        "1Password CLI",
        "1Password for Web",
        "1Password for Mac",
        "1Password SCIM Bridge",  # Used for automated account provisioning
        "1Password for Windows",
        "1Password for iOS",
        "1Password Browser Extension",
        "1Password for Android",
        "1Password for Linux",
        "1Password SDK",
    ]

    app_name = event.deep_get("client", "app_name")
    if not app_name:
        return False

    return app_name not in client_allowlist


def title(event):
    return f"Unusual 1Password client - {event.deep_get('client', 'app_name')} detected"


def alert_context(event):
    context = {}
    context["user"] = event.deep_get("target_user", "name", default="UNKNOWN_USER")
    context["user_email"] = event.udm("actor_user")
    context["ip_address"] = event.udm("source_ip")
    context["client"] = event.deep_get("client", "app_name", default="UNKNOWN_CLIENT")
    context["OS"] = event.deep_get("client", "os_name", default="UNKNOWN_OS")
    context["login_result"] = event.get("category")
    context["time_seen"] = event.get("timestamp")

    return context

AnalysisType: rule
Filename: onepassword_unusual_client.py
RuleID: "OnePassword.Unusual.Client"
DedupPeriodMinutes: 120
DisplayName: "Unusual 1Password Client Detected"
Enabled: true
LogTypes:
  - OnePassword.SignInAttempt
Severity: Medium
Description: Detects when unusual or undesirable 1Password clients access your 1Password account
Reference: https://support.1password.com/category/accounts/
Tags:
  - 1Password
  - Credential Access:Credentials from Password Stores
Reports:
  MITRE ATT&CK:
    - TA0006:T1555
SummaryAttributes:
  - p_any_ip_addresses
  - p_any_emails