detection.wiki

Detection rules › Panther

Detection content has been deleted from Panther

Severity
informational
Log types
Panther.Audit
Tags
DataModel, Defense Evasion:Impair Defenses
Reference
https://docs.panther.com/system-configuration/panther-audit-logs/querying-and-writing-detections-for-panther-audit-logs
Source
github.com/panther-labs/panther-analysis

Detection content has been removed from Panther.

MITRE ATT&CK coverage

TacticTechniques
StealthT1562 Impair Defenses

Rule body yaml

AnalysisType: rule
Filename: panther_detection_deleted.py
RuleID: "Panther.Detection.Deleted"
DisplayName: "Detection content has been deleted from Panther"
Enabled: true
LogTypes:
  - Panther.Audit
Severity: Info
Tags:
  - DataModel
  - Defense Evasion:Impair Defenses
Reports:
  MITRE ATT&CK:
    - TA0005:T1562
Description: Detection content has been removed from Panther.
Runbook: Ensure this change was approved and appropriate.
Reference: https://docs.panther.com/system-configuration/panther-audit-logs/querying-and-writing-detections-for-panther-audit-logs
SummaryAttributes:
  - p_any_ip_addresses
Tests:
  - Name: Delete 1 Detection
    ExpectedResult: true
    Log:
      {
        "actionName": "DELETE_DETECTION",
        "actionParams":
          {
            "dynamic":
              { "input": { "detections": [{ "id": "GitHub.Team.Modified" }] } },
          },
        "actionResult": "SUCCEEDED",
        "actor":
          {
            "attributes":
              {
                "email": "homer@springfield.gov",
                "emailVerified": true,
                "roleId": "11111111",
              },
            "id": "1111111",
            "name": "Homer Simpson",
            "type": "USER",
          },
        "errors": null,
        "p_log_type": "Panther.Audit",
        "sourceIP": "1.2.3.4",
        "timestamp": "2022-04-28 15:30:22.42",
      }
  - Name: Delete Many Detections
    ExpectedResult: true
    Log:
      {
        "actionName": "DELETE_DETECTION",
        "actionParams":
          {
            "dynamic":
              {
                "input":
                  {
                    "detections":
                      [
                        { "id": "Github.Repo.Created" },
                        { "id": "Okta.Global.MFA.Disabled" },
                        { "id": "Okta.AdminRoleAssigned" },
                        { "id": "Okta.BruteForceLogins" },
                      ],
                  },
              },
          },
        "actionResult": "SUCCEEDED",
        "actor":
          {
            "attributes":
              {
                "email": "homer@springfield.gov",
                "emailVerified": true,
                "roleId": "111111",
              },
            "id": "1111111",
            "name": "Homer Simpson",
            "type": "USER",
          },
        "errors": null,
        "p_log_type": "Panther.Audit",
        "sourceIP": "1.2.3.4.",
        "timestamp": "2022-04-28 15:34:43.067",
      }
  - Name: Non-Delete event
    ExpectedResult: false
    Log:
      {
        "actionName": "GET_GENERAL_SETTINGS",
        "actionParams": {},
        "actionResult": "SUCCEEDED",
        "actor":
          {
            "attributes":
              {
                "email": "homer@springfield.gov",
                "emailVerified": true,
                "roleId": "111111",
              },
            "id": "111111",
            "name": "Homer Simpson",
            "type": "USER",
          },
        "errors": null,
        "p_log_type": "Panther.Audit",
      }

Detection logic

Condition

actionName in ["DELETE_DATA_MODEL", "DELETE_DETECTION", "DELETE_DETECTION_PACK_SOURCE", "DELETE_GLOBAL_HELPER", "DELETE_LOOKUP_TABLE", "DELETE_SAVED_DATA_LAKE_QUERY"]
actionResult eq "SUCCEEDED"

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
actionNamein
  • DELETE_DATA_MODEL
  • DELETE_DETECTION
  • DELETE_DETECTION_PACK_SOURCE
  • DELETE_GLOBAL_HELPER
  • DELETE_LOOKUP_TABLE
  • DELETE_SAVED_DATA_LAKE_QUERY
actionResulteq
  • SUCCEEDED

Output fields

Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.

FieldSource
useractor_user
ipsource_ip