Panther rules: source

from ipaddress import ip_address

from panther_aws_helpers import eks_panther_obj_ref


# Alert if
#   state is ResponseComplete
#   sourceIPs[0] is a Public Address
#   responseStatus:code == 403
def rule(event):
    if event.get("stage", "") != "ResponseComplete":
        return False
    # We include only 403
    if event.get("responseStatus", {}).get("code", 0) != 403:
        return False
    # And we only want things that might naively be kubernetes api endpoints
    # we do not want to alert on scanners casting non-kubernetes requests.
    if not event.get("requestURI", "").startswith(("/api/", "/apis/")):
        return False
    p_eks = eks_panther_obj_ref(event)
    if not ip_address(p_eks.get("sourceIPs")[0]).is_global:
        return False
    return True


# If not defined, defaults to the rule display name or rule ID.
def title(event):
    p_eks = eks_panther_obj_ref(event)
    return (
        f"[{p_eks.get('sourceIPs')[0]}] received [403] "
        f"when executing [{p_eks.get('verb')}] "
        f"for resource [{p_eks.get('resource')}] "
        f"in ns [{p_eks.get('ns')}] on "
        f"[{p_eks.get('p_source_label')}] as "
        f"[{p_eks.get('actor')}]"
    )


def dedup(event):
    p_eks = eks_panther_obj_ref(event)
    return f"{p_eks.get('p_source_label')}_403_{p_eks.get('sourceIPs')[0]}"


def alert_context(event):
    p_eks = eks_panther_obj_ref(event)
    mutable_event = event.to_dict()
    mutable_event["p_eks"] = p_eks
    return dict(mutable_event)

AnalysisType: rule
Filename: source_ip_multiple_403.py
RuleID: "Amazon.EKS.Audit.Multiple403"
DisplayName: "EKS Audit Log based single sourceIP is generating multiple 403s"
Enabled: true
LogTypes:
  - Amazon.EKS.Audit
Tags:
  - EKS
Reports:
  MITRE ATT&CK:
    - "TA0007:T1613"
Reference: https://aws.github.io/aws-eks-best-practices/security/docs/detective/
Severity: Info
Description: > # (Optional)
  This detection identifies if a public sourceIP is generating multiple 403s
  with the Kubernetes API server.
DedupPeriodMinutes: 30 # The amount of time in minutes for grouping alerts (Optional, defaults to 60)
Threshold: 10 # The minimum number of event matches prior to an alert sending (Optional, defaults to 1)
SummaryAttributes: # A list of fields in the event to create top 5 summaries for (Optional)
  - user:username
  - p_any_ip_addresses
  - p_source_label