Panther rules: snyk

from panther_snyk_helpers import snyk_alert_context

ACTIONS = [
    "group.cloud_config.settings.edit",
    "group.feature_flags.edit",
]


def rule(event):

    action = event.get("event", "<NO_EVENT>")
    return action in ACTIONS


def title(event):
    group_or_org = "<GROUP_OR_ORG>"
    operation = "<NO_OPERATION>"
    action = event.get("event", "<NO_EVENT>")
    if "." in action:
        group_or_org = action.split(".")[0].title()
        operation = ".".join(action.split(".")[1:]).title()
    return (
        f"Snyk: [{group_or_org}] Setting "
        f"[{operation}] "
        f"performed by [{event.deep_get('userId', default='<NO_USERID>')}]"
    )


def alert_context(event):
    return snyk_alert_context(event)


def dedup(event):
    return (
        f"{event.deep_get('userId', default='<NO_USERID>')}"
        f"{event.deep_get('orgId', default='<NO_ORGID>')}"
        f"{event.deep_get('groupId', default='<NO_GROUPID>')}"
        f"{event.deep_get('event', default='<NO_EVENT>')}"
    )

AnalysisType: rule
Filename: snyk_misc_settings.py
RuleID: "Snyk.Misc.Settings"
DisplayName: "Snyk Miscellaneous Settings"
Enabled: true
LogTypes:
  - Snyk.GroupAudit
  - Snyk.OrgAudit
Tags:
  - Snyk
Reference: https://docs.snyk.io/snyk-admin/manage-settings
Severity: Low
Description: >
  Detects when Snyk settings that lack a clear security impact are changed
DedupPeriodMinutes: 60
Threshold: 1
SummaryAttributes:
  - event

from panther_snyk_helpers import snyk_alert_context

ACTIONS = [
    "group.create",
    "group.delete",
    "group.edit",
    "group.feature_flags.edit",
    "group.org.add",
    "group.org.remove",
    "group.settings.edit",
    "group.settings.feature_flag.edit",
    "org.create",
    "org.delete",
    "org.edit",
    "org.settings.feature_flag.edit",
]


def rule(event):

    action = event.get("event", "<NO_EVENT>")
    return action in ACTIONS


def title(event):
    group_or_org = "<GROUP_OR_ORG>"
    action = event.get("event", "<NO_EVENT>")
    if "." in action:
        group_or_org = action.split(".")[0].title()
    return (
        f"Snyk: [{group_or_org}] Organizational Unit settings have been modified "
        f"via [{action}] "
        f"performed by [{event.deep_get('userId', default='<NO_USERID>')}]"
    )


def alert_context(event):
    return snyk_alert_context(event)


def dedup(event):
    return (
        f"{event.deep_get('userId', default='<NO_USERID>')}"
        f"{event.deep_get('orgId', default='<NO_ORGID>')}"
        f"{event.deep_get('groupId', default='<NO_GROUPID>')}"
        f"{event.deep_get('event', default='<NO_EVENT>')}"
    )


def severity(event):
    action = event.get("event", "<NO_EVENT>")
    if action.endswith((".remove", ".delete")):
        return "HIGH"
    if action.endswith((".edit")):
        return "MEDIUM"
    return "INFO"

AnalysisType: rule
Filename: snyk_ou_change.py
RuleID: "Snyk.OU.Change"
DisplayName: "Snyk Org or Group Settings Change"
Enabled: true
LogTypes:
  - Snyk.GroupAudit
  - Snyk.OrgAudit
Tags:
  - Snyk
Severity: High
Description: >
  Detects when Snyk Group or Organization Settings are changed.
Runbook: |
  These actions in the Snyk Audit logs indicate that a Organization or
  Group setting has changed, including Group and Org creation/deletion.
  Deletion events are marked with HIGH severity
  Creation events are marked with INFO severity
  Edit events are marked with MEDIUM Severity

Reference: https://docs.snyk.io/snyk-admin/introduction-to-snyk-administration
DedupPeriodMinutes: 60
Threshold: 1
SummaryAttributes:
  - event

from panther_snyk_helpers import snyk_alert_context

ACTIONS = [
    "org.integration.create",
    "org.integration.delete",
    "org.integration.edit",
    "org.integration.settings.edit",
    "org.request_access_settings.edit",
    "org.target.create",
    "org.target.delete",
    "org.webhook.add",
    "org.webhook.delete",
]


def rule(event):

    action = event.get("event", "<NO_EVENT>")
    return action in ACTIONS


def title(event):
    group_or_org = "<GROUP_OR_ORG>"
    operation = "<NO_OPERATION>"
    action = event.get("event", "<NO_EVENT>")
    if "." in action:
        group_or_org = action.split(".")[0].title()
        operation = ".".join(action.split(".")[1:]).title()
    return (
        f"Snyk: [{group_or_org}] Setting "
        f"[{operation}] "
        f"performed by [{event.deep_get('userId', default='<NO_USERID>')}]"
    )


def alert_context(event):
    return snyk_alert_context(event)


def dedup(event):
    return (
        f"{event.deep_get('userId', default='<NO_USERID>')}"
        f"{event.deep_get('orgId', default='<NO_ORGID>')}"
        f"{event.deep_get('groupId', default='<NO_GROUPID>')}"
        f"{event.deep_get('event', default='<NO_EVENT>')}"
    )

AnalysisType: rule
Filename: snyk_org_settings.py
RuleID: "Snyk.Org.Settings"
DisplayName: "Snyk Org Settings"
Enabled: true
LogTypes:
  - Snyk.GroupAudit
  - Snyk.OrgAudit
Tags:
  - Snyk
Reference: https://docs.snyk.io/snyk-admin/manage-settings/organization-general-settings
Severity: Medium
Description: >
  Detects when Snyk Organization settings, like Integrations and Webhooks, are changed
DedupPeriodMinutes: 60
Threshold: 1
SummaryAttributes:
  - event

from panther_snyk_helpers import snyk_alert_context

# The bodies of these actions are quite diverse.
# When projects are added, the logged detail is the sourceOrgId.
# org.project.stop_monitor is logged for individual files
#   that are ignored.


ACTIONS = [
    "org.sast_settings.edit",
    "org.project.attributes.edit",
    "org.project.add",
    "org.project.delete",
    "org.project.fix_pr.manual_open",
    "org.project.ignore.create",
    "org.project.ignore.delete",
    "org.project.ignore.edit",
    "org.project.monitor",
    "org.project.pr_check.edit",
    "org.project.remove",
    "org.project.settings.delete",
    "org.project.settings.edit",
    "org.project.stop_monitor",
    # AND the equivalent for licenses",
    "org.license_rule.create",
    "org.license_rule.delete",
    "org.license_rule.edit",
]


def rule(event):

    if event.deep_get("content", "after", "description") == "No new Code Analysis issues found":
        return False
    action = event.get("event", "<NO_EVENT>")
    return action in ACTIONS


def title(event):
    group_or_org = "<GROUP_OR_ORG>"
    operation = "<NO_OPERATION>"
    action = event.get("event", "<NO_EVENT>")
    if "." in action:
        group_or_org = action.split(".")[0].title()
        operation = ".".join(action.split(".")[1:]).title()
    return (
        f"Snyk: [{group_or_org}] "
        f"[{operation}] "
        f"performed by [{event.deep_get('userId', default='<NO_USERID>')}]"
    )


def alert_context(event):
    a_c = snyk_alert_context(event)
    # merge event in for the alert_context
    a_c.update(event)
    return a_c


def dedup(event):
    return (
        f"{event.deep_get('userId', default='<NO_USERID>')}"
        f"{event.deep_get('orgId', default='<NO_ORGID>')}"
        f"{event.deep_get('groupId', default='<NO_GROUPID>')}"
        f"{event.deep_get('event', default='<NO_EVENT>')}"
    )


def severity(event):
    action = event.get("event", "<NO_EVENT>")
    if action == "org.project.fix_pr.manual_open":
        return "INFO"
    return "LOW"

AnalysisType: rule
Filename: snyk_project_settings.py
RuleID: "Snyk.Project.Settings"
DisplayName: "Snyk Project Settings"
Enabled: true
LogTypes:
  - Snyk.GroupAudit
  - Snyk.OrgAudit
Tags:
  - Snyk
Reference: https://docs.snyk.io/snyk-admin/introduction-to-snyk-projects/view-and-edit-project-settings
Severity: Medium
Description: >
  Detects when Snyk Project settings are changed
DedupPeriodMinutes: 60
Threshold: 1
SummaryAttributes:
  - event

from panther_snyk_helpers import snyk_alert_context

ACTIONS = [
    "group.role.create",
    "group.role.edit",
    "group.user.role.create",
    "group.user.role.delete",
    "group.user.role.edit",
    "org.user.role.create",
    "org.user.role.delete",
    "org.user.role.details.edit",
    "org.user.role.edit",
    "org.user.role.permissions.edit",
]


def rule(event):

    action = event.get("event", "<NO_EVENT>")
    return action in ACTIONS


def title(event):
    group_or_org = "<GROUP_OR_ORG>"
    crud_operation = "<NO_OPERATION>"
    action = event.get("event", "<NO_EVENT>")
    if "." in action:
        group_or_org = action.split(".")[0].title()
        crud_operation = action.split(".")[-1].title()
    return (
        f"Snyk: [{group_or_org}] Role "
        f"[{crud_operation}] "
        f"performed by [{event.deep_get('userId', default='<NO_USERID>')}]"
    )


def alert_context(event):
    a_c = snyk_alert_context(event)
    role = event.deep_get("content", "after", "role", default=None)
    if not role and "afterRoleName" in event.get("content", {}):
        role = event.deep_get("content", "afterRoleName", default=None)
    if role:
        a_c["role_permission"] = role
    return a_c


def dedup(event):
    return (
        f"{event.deep_get('userId', default='<NO_USERID>')}"
        f"{event.deep_get('orgId', default='<NO_ORGID>')}"
        f"{event.deep_get('groupId', default='<NO_GROUPID>')}"
        f"{event.deep_get('event', default='<NO_EVENT>')}"
    )


def severity(event):
    role = event.deep_get("content", "after", "role", default=None)
    if not role and "afterRoleName" in event.get("content", {}):
        role = event.deep_get("content", "afterRoleName", default=None)
    if role == "ADMIN":
        return "CRITICAL"
    return "MEDIUM"

AnalysisType: rule
Filename: snyk_role_change.py
RuleID: "Snyk.Role.Change"
DisplayName: "Snyk Role Change"
Enabled: true
LogTypes:
  - Snyk.GroupAudit
  - Snyk.OrgAudit
Tags:
  - Snyk
Severity: High
Description: >
  Detects when Snyk Roles are changed
Runbook: |
  These actions in the Snyk Audit logs indicate that a ServiceAccount
  has been created/deleted/modified.

  All events where the Role is marked as ADMIN have CRITICAL severity
  Other events are marked with MEDIUM severity

Reference: https://docs.snyk.io/snyk-admin/manage-users-and-permissions/member-roles
DedupPeriodMinutes: 60
Threshold: 1
SummaryAttributes:
  - event

from panther_snyk_helpers import snyk_alert_context

ACTIONS = [
    "group.service_account.create",
    "group.service_account.delete",
    "group.service_account.edit",
    "org.service_account.create",
    "org.service_account.delete",
    "org.service_account.edit",
    "org.service_account.membership.upsert",
]


def rule(event):

    action = event.get("event", "<NO_EVENT>")
    return action in ACTIONS


def title(event):
    group_or_org = "<GROUP_OR_ORG>"
    crud_operation = "<NO_OPERATION>"
    action = event.get("event", "<NO_EVENT>")
    if "." in action:
        group_or_org = action.split(".")[0].title()
        crud_operation = action.split(".")[-1].title()
    return (
        f"Snyk: [{group_or_org}] Service Account "
        f"[{crud_operation}] "
        f"performed by [{event.deep_get('userId', default='<NO_USERID>')}]"
    )


def alert_context(event):
    a_c = snyk_alert_context(event)
    role = event.deep_get("content", "role", "role", default=None)
    if not role:
        role = event.deep_get("content", "role", default=None)
    if role:
        a_c["role_permission"] = role
    return a_c


def dedup(event):
    return (
        f"{event.deep_get('userId', default='<NO_USERID>')}"
        f"{event.deep_get('orgId', default='<NO_ORGID>')}"
        f"{event.deep_get('groupId', default='<NO_GROUPID>')}"
        f"{event.deep_get('event', default='<NO_EVENT>')}"
    )


def severity(event):
    action = event.get("event", "<NO_EVENT>")
    role = event.deep_get("content", "role", "role", default=None)
    if not role:
        role = event.deep_get("content", "role", default=None)
    if all(
        [role == "ADMIN", action.endswith((".service_account.create", ".service_account.delete"))]
    ):
        return "CRITICAL"
    if action.endswith((".service_account.create", ".service_account.delete")):
        return "HIGH"
    return "MEDIUM"

AnalysisType: rule
Filename: snyk_svcacct_change.py
RuleID: "Snyk.ServiceAccount.Change"
DisplayName: "Snyk Service Account Change"
Enabled: true
LogTypes:
  - Snyk.GroupAudit
  - Snyk.OrgAudit
Tags:
  - Snyk
Severity: High
Description: >
  Detects when Snyk Service Accounts are changed
Runbook: |
  These actions in the Snyk Audit logs indicate that a ServiceAccount
  has been created/deleted/modified.

  Service Accounts are system user accounts with an API token
  associated to it in place of standard user credentials.
  All events where the Service Account's role is ADMIN have CRITICAL severity
  Deletion events are marked with HIGH severity
  Creation events are marked with HIGH severity
  Edit events are marked with MEDIUM Severity

Reference: https://docs.snyk.io/snyk-admin/service-accounts
DedupPeriodMinutes: 60
Threshold: 1
SummaryAttributes:
  - event

from panther_snyk_helpers import snyk_alert_context

ACTIONS = [
    "group.request_access_settings.edit",
    "org.request_access_settings.edit",
]


def rule(event):

    action = event.get("event", "<NO_EVENT>")
    return action in ACTIONS


def title(event):
    current_setting = event.deep_get("content", "after", "isEnabled", default=False)
    action = event.get("event", "<NO_EVENT>")
    if "." in action:
        action = action.split(".")[0].title()
    return (
        f"Snyk: [{action}] External Access settings have been modified "
        f"to PermitExternalUsers:[{current_setting}] "
        f"performed by [{event.deep_get('userId', default='<NO_USERID>')}]"
    )


def alert_context(event):
    a_c = snyk_alert_context(event)
    current_setting = event.deep_get("content", "after", "isEnabled", default=False)
    a_c["current_setting"] = current_setting
    return a_c


def dedup(event):
    return (
        f"{event.deep_get('userId', default='<NO_USERID>')}"
        f"{event.deep_get('orgId', default='<NO_ORGID>')}"
        f"{event.deep_get('groupId', default='<NO_GROUPID>')}"
    )


def severity(event):
    current_setting = event.deep_get("content", "after", "isEnabled", default=False)
    if current_setting:
        return "HIGH"
    return "INFO"

AnalysisType: rule
Filename: snyk_system_externalaccess.py
RuleID: "Snyk.System.ExternalAccess"
DisplayName: "Snyk System External Access Settings Changed"
Enabled: true
LogTypes:
  - Snyk.GroupAudit
  - Snyk.OrgAudit
Tags:
  - Snyk
Severity: High
Description: >
  Detects when Snyk Settings that control access for external parties have been changed.
Runbook: |
  This action in the Snyk Audit logs indicate that the setting for allowing external
  parties to request access to your Snyk installation have changed.
Reference: https://docs.snyk.io/snyk-admin/manage-users-and-permissions/organization-access-requests
DedupPeriodMinutes: 60
Threshold: 1
SummaryAttributes:
  - event

from panther_snyk_helpers import snyk_alert_context

ACTIONS = [
    "group.policy.create",
    "group.policy.delete",
    "group.policy.edit",
    "org.policy.edit",
    "org.ignore_policy.edit",
]


def rule(event):

    action = event.get("event", "<NO_EVENT>")
    return action in ACTIONS


def title(event):
    policy_type = "<NO_POLICY_TYPE_FOUND>"
    license_or_rule = event.deep_get("content", "after", "configuration", default={})
    if "rules" in license_or_rule:
        policy_type = "security"
    elif "licenses" in license_or_rule:
        policy_type = "license"
    return (
        f"Snyk: System [{policy_type}] Policy Setting event "
        f"[{event.deep_get('event', default='<NO_EVENT>')}] "
        f"performed by [{event.deep_get('userId', default='<NO_USERID>')}]"
    )


def alert_context(event):
    a_c = snyk_alert_context(event)
    a_c["policy_type"] = "<NO_POLICY_TYPE_FOUND>"
    license_or_rule = event.deep_get("content", "after", "configuration", default={})
    if "rules" in license_or_rule:
        a_c["policy_type"] = "security"
    elif "licenses" in license_or_rule:
        a_c["policy_type"] = "license"
    return a_c


def dedup(event):
    # Licenses can apply at org or group levels
    return (
        f"{event.deep_get('userId', default='<NO_USERID>')}"
        f"{event.deep_get('orgId', default='<NO_ORGID>')}"
        f"{event.deep_get('groupId', default='<NO_GROUPID>')}"
        f"{event.deep_get('content', 'publicId', default='<NO_PUBLICID>')}"
    )

AnalysisType: rule
Filename: snyk_system_policysetting.py
RuleID: "Snyk.System.PolicySetting"
DisplayName: "Snyk System Policy Settings Changed"
Enabled: true
LogTypes:
  - Snyk.GroupAudit
  - Snyk.OrgAudit
Tags:
  - Snyk
Severity: High
Description: >
  Detects Snyk Policy Settings have been changed.
  Policies define Snyk's behavior when encountering security and licensing issues.
Runbook: |
  Snyk Policies can cause alerts to raise or not based on found security and
  license issues. Validate that that this change is expected.
Reference: https://docs.snyk.io/manage-issues/policies/shared-policies-overview
DedupPeriodMinutes: 60
Threshold: 1
SummaryAttributes:
  - event

from panther_snyk_helpers import snyk_alert_context

ACTIONS = [
    "group.sso.auth0_connection.create",
    "group.sso.auth0_connection.edit",
    "group.sso.create",
    "group.sso.edit",
]


def rule(event):

    action = event.get("event", "<NO_EVENT>")
    return action in ACTIONS


def title(event):
    return (
        "Snyk: System SSO Setting event "
        f"[{event.deep_get('event', default='<NO_EVENT>')}] "
        f"performed by [{event.deep_get('userId', default='<NO_USERID>')}]"
    )


def alert_context(event):
    return snyk_alert_context(event)

AnalysisType: rule
Filename: snyk_system_sso.py
RuleID: "Snyk.System.SSO"
DisplayName: "Snyk System SSO Settings Changed"
Enabled: true
LogTypes:
  - Snyk.GroupAudit
Tags:
  - Snyk
Severity: High
Description: >
  Detects Snyk SSO Settings have been changed.
  The reference URL from Snyk indicates that these events are likely to
  originate exclusively from Snyk Support.
Reference: https://docs.snyk.io/user-and-group-management/setting-up-sso-for-authentication/set-up-snyk-single-sign-on-sso
DedupPeriodMinutes: 60
Threshold: 1
SummaryAttributes:
  - event
  - p_any_ip_addresses
  - p_any_emails

from panther_snyk_helpers import snyk_alert_context

ACTIONS = [
    "group.user.add",
    "group.user.provision.accept",
    "group.user.provision.create",
    "group.user.provision.delete",
    "group.user.remove",
    "org.user.add",
    "org.user.invite",
    "org.user.invite.accept",
    "org.user.invite.revoke",
    "org.user.invite_link.accept",
    "org.user.invite_link.create",
    "org.user.invite_link.revoke",
    "org.user.leave",
    "org.user.provision.accept",
    "org.user.provision.create",
    "org.user.provision.delete",
    "org.user.remove",
]


def rule(event):

    action = event.get("event", "<NO_EVENT>")
    # for org.user.add/group.user.add via SAML/SCIM
    # the attributes .userId and .content.publicUserId
    # have the same value
    if action.endswith(".user.add"):
        target_user = event.deep_get("content", "userPublicId", default="<NO_CONTENT_UID>")
        actor = event.get("userId", "<NO_USERID>")
        if target_user == actor:
            return False
    return action in ACTIONS


def title(event):
    group_or_org = "<GROUP_OR_ORG>"
    operation = "<NO_OPERATION>"
    action = event.get("event", "<NO_EVENT>")
    if "." in action:
        group_or_org = action.split(".")[0].title()
        operation = ".".join(action.split(".")[2:]).title()
    return (
        f"Snyk: [{group_or_org}] User "
        f"[{operation}] "
        f"performed by [{event.deep_get('userId', default='<NO_USERID>')}]"
    )


def alert_context(event):
    return snyk_alert_context(event)


def dedup(event):
    return (
        f"{event.deep_get('userId', default='<NO_USERID>')}"
        f"{event.deep_get('orgId', default='<NO_ORGID>')}"
        f"{event.deep_get('groupId', default='<NO_GROUPID>')}"
        f"{event.deep_get('event', default='<NO_EVENT>')}"
    )


def severity(event):
    role = event.deep_get("content", "after", "role", default=None)
    if not role and "afterRoleName" in event.get("content", {}):
        role = event.deep_get("content", "afterRoleName", default=None)
    if role == "ADMIN":
        return "CRITICAL"
    return "MEDIUM"

AnalysisType: rule
Filename: snyk_user_mgmt.py
RuleID: "Snyk.User.Management"
DisplayName: "Snyk User Management"
Enabled: true
LogTypes:
  - Snyk.GroupAudit
  - Snyk.OrgAudit
Tags:
  - Snyk
Severity: Medium
Description: >
  Detects when Snyk Users are changed
Runbook: |
  These actions in the Snyk Audit logs indicate that a User
  has been created/deleted/modified.

Reference: https://docs.snyk.io/snyk-admin/manage-users-and-permissions/member-roles
DedupPeriodMinutes: 60
Threshold: 1
SummaryAttributes:
  - event