Panther rules: socradar

def rule(event):
    return event.get("status") != "CLOSED"


def title(event):
    main_type = event.deep_get("alarm_type_details", "alarm_main_type", default="Unknown")
    sub_type = event.deep_get("alarm_type_details", "alarm_sub_type", default="")
    risk = event.get("alarm_risk_level", "UNKNOWN")
    return f"SOCRadar {risk} [{main_type} - {sub_type}]"


def severity(event):
    return event.get("alarm_risk_level", "DEFAULT").upper()


def dedup(event):
    return str(event.get("alarm_id", ""))


def alert_context(event):
    context = {
        "alarm_id": event.get("alarm_id"),
        "alarm_asset": event.get("alarm_asset"),
        "alarm_text": event.get("alarm_text"),
        "main_type": event.deep_get("alarm_type_details", "alarm_main_type"),
        "sub_type": event.deep_get("alarm_type_details", "alarm_sub_type"),
        "status": event.get("status"),
        "mitigation": event.deep_get("alarm_type_details", "alarm_default_mitigation_plan"),
    }

    content = event.get("content") or {}
    for field in (
        "content_link",
        "phishing_domain",
        "phishing_domain_url",
        "compromised_emails",
        "compromised_ips",
        "compromised_domains",
        "malware_family",
        "computer_name",
        "username",
        "source",
        "content_preview",
    ):
        if content.get(field):
            context[field] = content[field]

    return context

AnalysisType: rule
Filename: socradar_alert_passthrough.py
RuleID: "SOCRadar.Alert.Passthrough"
DisplayName: "SOCRadar Alert Passthrough"
Enabled: true
Status: Experimental
LogTypes:
  - SOCRadar.Incidents
Tags:
  - SOCRadar
  - Threat Intelligence
  - Brand Protection
  - Dark Web
  - Credential Intelligence
  - Attack Surface
DedupPeriodMinutes: 60
Severity: Info
Description: >
  Surfaces all open SOCRadar security incidents as Panther alerts. Severity is mapped
  dynamically from SOCRadar's alarm_risk_level (CRITICAL/HIGH/MEDIUM/LOW/INFO).
  SOCRadar performs the underlying threat detection; this rule ensures every open
  incident is visible in Panther for triage and response.
Runbook: |
  1. Review the full alert context including alarm_id, alarm_type_details.alarm_main_type, alarm_type_details.alarm_sub_type, and all content fields (phishing_domain, compromised_emails, malware_family, content_link) to understand the nature and scope of the SOCRadar incident.
  2. Check whether any extracted indicators (p_any_ip_addresses, p_any_domain_names, p_any_emails, p_any_usernames) appear in other log sources or security alerts in the 24 hours before and after this alert to determine if the threat has already reached internal systems.
  3. Search for other SOCRadar incidents with the same alarm_type_details.alarm_main_type or alarm_asset in the past 30 days to identify whether this is an isolated finding or part of a recurring or escalating threat pattern.
Reference: https://socradar.io/incident-response/
SummaryAttributes:
  - alarm_id
  - alarm_risk_level
  - alarm_asset
  - status
  - p_any_ip_addresses
  - p_any_domain_names
  - p_any_emails
  - p_any_usernames