Panther rules: push

def rule(event):
    if event.get("object") != "APP_BANNER":
        return False

    if event.deep_get("new", "action") == "ACKNOWLEDGED":
        return True

    return False


def title(event):
    app_type = event.deep_get("new", "appType")
    employee_email = event.deep_get("new", "employee", "email")
    return f"{app_type} accessed by {employee_email}"


def alert_context(event):
    return {
        "Push Security app banner": event.deep_get("new", "appBanner", "mode"),
        "Title": event.deep_get("new", "appBanner", "title"),
        "Subtext": event.deep_get("new", "appBanner", "subtext"),
        "Button": event.deep_get("new", "appBanner", "buttonText"),
    }

AnalysisType: rule
Filename: push_security_app_banner_acknowledged.py
RuleID: "Push.Security.App.Banner.Acknowledged"
DisplayName: "Push Security App Banner Acknowledged"
Enabled: true
LogTypes:
  - PushSecurity.Activity
Severity: Low
DedupPeriodMinutes: 60
Threshold: 1

# Configure allowed identity provider logins to SaaS apps
allowed_idps = {
    # "GOOGLE_WORKSPACE": {"OIDC_LOGIN", "SAML_LOGIN"},
    "OKTA": {"PASSWORD_LOGIN"},
}


def rule(event):
    if event.get("object") != "LOGIN":
        return False

    identity_provider = event.deep_get("new", "identityProvider")
    login_type = event.deep_get("new", "loginType")

    if identity_provider in allowed_idps and login_type in allowed_idps[identity_provider]:
        return True
    return False


def title(event):
    identity_provider = event.deep_get("new", "identityProvider", default="Null identityProvider")
    login_type = event.deep_get("new", "loginType", default="Null loginType")
    app_type = event.deep_get("new", "appType", default="Null appType")
    new_email = event.deep_get("new", "email")

    return f"Authorized identity provider in use. User: {new_email} \
        used {identity_provider} {login_type} on {app_type}"

AnalysisType: rule
Filename: push_security_authorized_idp_login.py
RuleID: "Push.Security.Authorized.IdP.Login"
DisplayName: "Push Security Authorized IdP Login"
Enabled: false
CreateAlert: false
LogTypes:
  - PushSecurity.Activity
Tags:
  - Configuration Required
Severity: Info
Description: Login to application with unauthorized identity provider which could indicate a SAMLjacking attack.
DedupPeriodMinutes: 60
Threshold: 1
Reference: https://github.com/pushsecurity/saas-attacks/blob/main/techniques/samljacking/description.md
InlineFilters:
  - All: []

def rule(event):
    if event.get("object") != "APP":
        return False

    if event.get("type") == "CREATE":
        return True

    return False


def title(event):
    new_type = event.deep_get("new", "type")
    return f"New app in use: {new_type}"

AnalysisType: rule
Filename: push_security_new_app_detected.py
RuleID: "Push.Security.New.App.Detected"
DisplayName: "Push Security New App Detected"
Enabled: true
LogTypes:
  - PushSecurity.Entities
Severity: Info
DedupPeriodMinutes: 60
Threshold: 1

def rule(event):
    if event.get("object") != "ACCOUNT":
        return False

    if event.get("type") == "CREATE":
        return True

    return False


def title(event):
    app_type = event.deep_get("new", "appType")
    new_email = event.deep_get("new", "email")
    return f"New account on {app_type} created by {new_email}"

AnalysisType: rule
Filename: push_security_new_saas_account_created.py
RuleID: "Push.Security.New.SaaS.Account.Created"
DisplayName: "Push Security New SaaS Account Created"
Enabled: true
LogTypes:
  - PushSecurity.Entities
Severity: Info
DedupPeriodMinutes: 60
Threshold: 1

def rule(event):
    if event.get("object") != "FINDING":
        return False

    event_type = event.get("type")

    if event_type == "CREATE":
        return True

    if event_type == "UPDATE" and event.deep_get("new", "state") == "OPEN":
        return True

    return False


def title(event):
    new_type = event.deep_get("new", "type")
    app_type = event.deep_get("new", "appType")
    return f"Open finding {new_type} for app {app_type}"

AnalysisType: rule
Filename: push_security_open_security_finding.py
RuleID: "Push.Security.Open.Security.Finding"
DisplayName: "Push Security Open Security Finding"
Enabled: true
LogTypes:
  - PushSecurity.Entities
Severity: Info
DedupPeriodMinutes: 60
Threshold: 1

identity_providers = ("MICROSOFT_365", "GOOGLE_WORKSPACE", "OKTA", "JUMPCLOUD", "PING")

phishable_mfa = ("EMAIL_OTP", "PHONE_CALL", "SMS", "APP_PASSWORD")


def rule(event):
    if event.get("object") != "ACCOUNT":
        return False

    mfa_methods = event.deep_get("new", "mfaMethods")

    for method in mfa_methods:
        if method in phishable_mfa:
            return True

    return False


def severity(event):
    if event.deep_get("new", "appType") in identity_providers:
        return "HIGH"
    return "INFO"


def title(event):
    mfa_methods = ", ".join(event.deep_get("new", "mfaMethods", default="No MFA"))
    new_email = event.deep_get("new", "email")
    app_type = event.deep_get("new", "appType", default=[])

    return f"{new_email} using phishable MFA method with {app_type}. \
            MFA methods enabled: {mfa_methods}"

AnalysisType: rule
Filename: push_security_phishable_mfa_method.py
RuleID: "Push.Security.Phishable.MFA.Method"
DisplayName: "Push Security Phishable MFA Method"
Enabled: true
LogTypes:
  - PushSecurity.Entities
Severity: Info
DedupPeriodMinutes: 60
Threshold: 1

def rule(event):
    if event.get("object") == "PASSWORD_PHISHING":
        return True

    return False


def severity(event):
    if event.deep_get("new", "mode") != "BLOCK":
        return "HIGH"
    return "LOW"


def title(event):
    app_type = event.deep_get("new", "appType")
    employee_email = event.deep_get("new", "employee", "email")
    new_mode = event.deep_get("new", "mode")
    return f"Phishing attack on app {app_type} user {employee_email}. \
             Attack detected in mode {new_mode}."

AnalysisType: rule
Filename: push_security_phishing_attack.py
RuleID: "Push.Security.Phishing.Attack"
DisplayName: "Push Security Phishing Attack"
Enabled: true
LogTypes:
  - PushSecurity.Controls
Severity: High
DedupPeriodMinutes: 60
Threshold: 1

def rule(event):
    if event.get("object") != "ACCOUNT":
        return False

    if event.get("old") is None:
        return False

    new_mfa_methods = set(event.deep_get("new", "mfaMethods"))
    old_mfa_methods = set(event.deep_get("old", "mfaMethods", default=[]))

    if new_mfa_methods != old_mfa_methods:
        return True

    return False


def severity(event):
    if event.deep_get("new", "mfaMethods") == []:
        return "HIGH"
    return "LOW"


def title(event):
    mfa_methods = ", ".join(event.deep_get("new", "mfaMethods", default="No MFA"))
    new_email = event.deep_get("new", "email")
    new_apptype = event.deep_get("new", "appType")

    if mfa_methods == "":
        return f"{new_email} removed all MFA methods on {new_apptype}"
    return f"{new_email} changed MFA method to {mfa_methods} on {new_apptype}"

AnalysisType: rule
Filename: push_security_mfa_method_changed.py
RuleID: "Push.Security.MFA.Method.Changed"
DisplayName: "Push Security SaaS App MFA Method Changed"
Enabled: true
LogTypes:
  - PushSecurity.Entities
Severity: Info
Description: MFA method on SaaS app changed
DedupPeriodMinutes: 60
Threshold: 1

# Configure allowed identity provider logins to SaaS apps
allowed_idps = {
    "GOOGLE_WORKSPACE": {"OIDC_LOGIN", "SAML_LOGIN"},
    "OKTA": {"PASSWORD_LOGIN"},
    None: {"PASSWORD_LOGIN"},
}


def rule(event):
    if event.get("object") != "LOGIN":
        return False

    identity_provider = event.deep_get("new", "identityProvider")
    login_type = event.deep_get("new", "loginType")

    if identity_provider in allowed_idps and login_type in allowed_idps[identity_provider]:
        return False

    return True


def title(event):
    identity_provider = event.deep_get("new", "identityProvider", default="Null identityProvider")
    login_type = event.deep_get("new", "loginType", default="Null loginType")
    app_type = event.deep_get("new", "appType", default="Null appType")
    new_email = event.deep_get("new", "email")

    return f"Unauthorized identity provider in use. User: {new_email} \
        used {identity_provider} {login_type} on {app_type}"

AnalysisType: rule
Filename: push_security_unauthorized_idp_login.py
RuleID: "Push.Security.Unauthorized.IdP.Login"
DisplayName: "Push Security Unauthorized IdP Login"
Enabled: false
Tags:
  - Configuration Required
LogTypes:
  - PushSecurity.Activity
Severity: High
Description: Login to application with unauthorized identity provider which could indicate a SAMLjacking attack.
Reference: https://github.com/pushsecurity/saas-attacks/blob/main/techniques/samljacking/description.md
DedupPeriodMinutes: 60
Threshold: 1