Detection rules › Panther

Panther rules: tracebit

Rule	Severity
Tracebit Alert	`medium`

Tracebit Alert

Severity: medium
Group by: alert_id
Log types: Tracebit.Alert
Source: github.com/panther-labs/panther-analysis

Tracebit maintains security canaries across your organization to detect potential intrusions. This alert indicates that Tracebit has detected activity on security canaries.

Detection logic

def rule(event):
    return event.deep_get("discriminator", "type") == "tracebit_alert_log"


def title(event):
    return f"Tracebit: {event.get('message')}"


def dedup(event):
    # Deduplicate alerts on the alert_id since there can be multiple alert logs for a single alert
    return event.get("alert_id")


def reference(event):
    # Reference the alert in the Tracebit portal to allow for easy investigation
    return event.get("tracebit_portal_url")


def severity(event):
    # Override the default alert severity if the alert log has a high severity
    if event.get("severity") == "High":
        return "HIGH"
    return "DEFAULT"


def alert_context(event):
    return event.get("canary", {})

Rule specification

AnalysisType: rule
Filename: tracebit_alert.py
RuleID: "Tracebit.Alert"
DisplayName: "Tracebit Alert"
Enabled: true
LogTypes:
    - Tracebit.Alert
Severity: Medium
Description: |-
    Tracebit maintains security canaries across your organization to detect potential intrusions.

    This alert indicates that Tracebit has detected activity on security canaries.
DedupPeriodMinutes: 1440
Threshold: 1

Stages and Predicates

Fires on Tracebit.Alert events when the condition below holds.

Condition

discriminator.type is tracebit_alert_log

Alert deduplication: repeat matches within 1d group into one alert

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`discriminator.type`	eq	`tracebit_alert_log`	`field:"discriminator.type" kind:eq value:"tracebit_alert_log"`

Output fields

Fields the rule emits when it matches, drawn from the rule's alert_context.

Field
`message`

Worked example

A sample event from the rule's unit tests that triggers a match.

Sample Test Event

{
  "alert_id": "62a3b514-50f2-4321-9117-73cab9690b15",
  "canary": {
    "aws": {
      "account_id": "613260573123",
      "account_name": "companyx-prod",
      "arn": "arn:aws:s3:::companyx-development-quarterly-monitor"
    },
    "name": "companyx-development-quarterly-monitor",
    "provider_account_id": "613260573123",
    "provider_id": "arn:aws:s3:::companyx-development-quarterly-monitor",
    "tracebit_id": "00ee51db-fb6d-4f9f-8be8-f0db6004d9f0",
    "type": "AWS::S3::Bucket"
  },
  "discriminator": {
    "subtype": "canary_resource_accessed",
    "type": "tracebit_alert_log"
  },
  "event": {
    "id": "dfada3b1-5683-4a19-b392-7188a0ee8dbc",
    "operation": "ListObjects",
    "request": {
      "ip": "212.36.35.20",
      "user_agent": {
        "label": "AWS Console",
        "raw": "[S3Console/0.4, aws-internal/3 aws-sdk-java/1.12.750 Linux/5.10.223-190.873.amzn2int.x86_64 OpenJDK_64-Bit_Server_VM/25.412-b09 java/1.8.0_412 vendor/Oracle_Corporation cfg/retry-mode/standard]"
      }
    },
    "resources": [
      {
        "id": "companyx-development-quarterly-monitor",
        "type": "AWS::S3::Bucket"
      },
      {
        "id": "companyx-development-quarterly-monitor/backup/",
        "type": "AWS::S3::Object"
      }
    ]
  },
  "id": "dfada3b1-5683-4a19-b392-7188a0ee8dbc",
  "message": "Canary resource activity detected in AWS",
  "principal": {
    "aws": {
      "account_id": "613260573123",
      "arn": "arn:aws:sts::613260573123:assumed-role/AWSReservedSSO_ExampleAdmin_8f33df3b277bcg12/john.smith@companyx.com",
      "type": "AssumedRole"
    },
    "id": "AWSReservedSSO_ExampleAdmin_8f33df3b277bcg12/john.smith@companyx.com"
  },
  "provider": "aws",
  "severity": "Medium",
  "timestamp": "2024-09-04T08:06:28Z",
  "tracebit_portal_url": "https://companyx.tracebit.com/alerts/62a3b514-50f2-4321-9117-73cab9690b15"
}