Panther rules: upwind

from panther_upwind_helpers import (
    upwind_base_alert_context,
    upwind_format_initiators,
    upwind_format_mitre_attacks,
    upwind_is_known_severity,
    upwind_severity,
)

# Upwind API detections cover broken authentication/authorization, injection,
# mass assignment, token misuse, sensitive data exposure, and API abuse patterns.
API_KEYWORDS = ("api",)


def rule(event):
    category = event.get("category", "").lower()
    return upwind_is_known_severity(event) and any(kw in category for kw in API_KEYWORDS)


def title(event):
    return f"[Upwind API]: {event.get('title', '<NO TITLE>')}"


def severity(event):
    return upwind_severity(event)


def dedup(event):
    return f"{event.get('id', '<NO ID>')}_{event.get('severity', '<NO SEVERITY>')}"


def description(event):
    return event.get("description") or "DEFAULT"


def reference(event):
    return event.get("upwind_console_link") or "DEFAULT"


def alert_context(event):
    ctx = upwind_base_alert_context(event)
    ctx["initiators"] = upwind_format_initiators(event)
    ctx["mitre_attacks"] = upwind_format_mitre_attacks(event)
    return ctx

AnalysisType: rule
RuleID: Upwind.Detection.API.Passthrough
DisplayName: Upwind API Detection Passthrough
Description: >
  Re-raises Upwind API security detections in Panther. Covers broken authentication,
  authorization flaws, injection, mass assignment, token misuse, and sensitive data
  exposure patterns detected at the API layer.
Runbook: |
  1. Query Upwind.Detections for all API threat detections against resource.name in the 24 hours before and after this alert to establish the scope of API abuse
  2. Review triggers[].events[].initiator fields (name, arn, userName, accountId) and determine whether this initiating entity has a history of legitimate access to this service in the past 30 days
  3. Search for other alerts from the same triggers[].events[].initiator.arn or triggers[].events[].initiator.accountId in the past 7 days to identify credential misuse or account compromise
Reference: https://docs.upwind.io/restapi/v1/get-threat-detection
Enabled: true
Filename: upwind_api_detection_passthrough.py
Severity: Medium
Status: Experimental
LogTypes:
  - Upwind.Detections
DedupPeriodMinutes: 720
Threshold: 1
Reports:
  MITRE ATT&CK:
    - TA0001:T1190  # Initial Access: Exploit Public-Facing Application
Tags:
  - Upwind
  - Passthrough
  - API
  - Initial Access
  - Exploit Public-Facing Application

from panther_upwind_helpers import (
    upwind_base_alert_context,
    upwind_format_mitre_attacks,
    upwind_is_known_severity,
    upwind_severity,
)

# Upwind network detections cover port scans, DoS activity, DNS anomalies,
# DNS-over-HTTPS abuse, and other anomalous network behaviors.
NETWORK_KEYWORDS = ("network",)

# Defer to higher-priority rules when their keywords also appear in the category
NETWORK_EXCLUSIONS = ("api", "vulnerab")


def rule(event):
    category = event.get("category", "").lower()
    return (
        upwind_is_known_severity(event)
        and any(kw in category for kw in NETWORK_KEYWORDS)
        and not any(ex in category for ex in NETWORK_EXCLUSIONS)
    )


def title(event):
    return f"[Upwind Network]: {event.get('title', '<NO TITLE>')}"


def severity(event):
    return upwind_severity(event)


def dedup(event):
    return f"{event.get('id', '<NO ID>')}_{event.get('severity', '<NO SEVERITY>')}"


def description(event):
    return event.get("description") or "DEFAULT"


def reference(event):
    return event.get("upwind_console_link") or "DEFAULT"


def alert_context(event):
    ctx = upwind_base_alert_context(event)
    ctx["mitre_attacks"] = upwind_format_mitre_attacks(event)
    return ctx

AnalysisType: rule
RuleID: Upwind.Detection.Network.Passthrough
DisplayName: Upwind Network Detection Passthrough
Description: >
  Re-raises Upwind network security detections in Panther. Covers port scans, DoS activity,
  DNS anomalies, DNS-over-HTTPS abuse, and other anomalous network behaviors.
Runbook: |
  1. Query Upwind.Detections for all network detections against resource.name in the 24 hours before this alert to determine if this is isolated or part of a sustained pattern
  2. Check whether resource.internet_exposure.ingress.active_communication is true and correlate with cloud network flow logs for the affected resource.region and resource.cloud_account_id to identify external actors involved
  3. Search for other HIGH or CRITICAL alerts from the same resource.cloud_account_id in the past 7 days to determine whether this network anomaly is associated with broader threat activity
Reference: https://docs.upwind.io/restapi/v1/get-threat-detection
Enabled: true
Filename: upwind_network_detection_passthrough.py
Severity: Medium
Status: Experimental
LogTypes:
  - Upwind.Detections
DedupPeriodMinutes: 720
Threshold: 1
Reports:
  MITRE ATT&CK:
    - TA0007:T1046  # Discovery: Network Service Discovery
Tags:
  - Upwind
  - Passthrough
  - Network
  - Discovery
  - Network Service Discovery

from panther_upwind_helpers import (
    upwind_base_alert_context,
    upwind_is_known_severity,
    upwind_severity,
    upwind_triggered_policies,
)

# Upwind posture detections cover cloud misconfigurations, exposed secrets,
# configuration drift, and CSPM policy violations.
# Note: "config" intentionally excluded — too broad and covered by "misconfigur".
POSTURE_KEYWORDS = ("posture", "cspm", "misconfigur")

# Defer to higher-priority rules when their keywords also appear in the category
POSTURE_EXCLUSIONS = ("api", "vulnerab", "network")


def rule(event):
    category = event.get("category", "").lower()
    return (
        upwind_is_known_severity(event)
        and any(kw in category for kw in POSTURE_KEYWORDS)
        and not any(ex in category for ex in POSTURE_EXCLUSIONS)
    )


def title(event):
    return f"[Upwind Posture]: {event.get('title', '<NO TITLE>')}"


def severity(event):
    return upwind_severity(event)


def dedup(event):
    return f"{event.get('id', '<NO ID>')}_{event.get('severity', '<NO SEVERITY>')}"


def description(event):
    return event.get("description") or "DEFAULT"


def reference(event):
    return event.get("upwind_console_link") or "DEFAULT"


def alert_context(event):
    ctx = upwind_base_alert_context(event)
    ctx["triggered_policies"] = upwind_triggered_policies(event)
    return ctx

AnalysisType: rule
RuleID: Upwind.Detection.Posture.Passthrough
DisplayName: Upwind Posture Detection Passthrough
Description: >
  Re-raises Upwind cloud posture and CSPM detections in Panther. Covers cloud
  misconfigurations, exposed secrets, configuration drift, and CSPM policy violations.
Runbook: |
  1. Query Upwind.Detections for all posture findings for the same resource.cloud_account_id and resource.type in the past 30 days to determine whether this is an isolated misconfiguration or a systemic issue across the account
  2. Review resource.risk_categories and triggers[].policy_name to assess the exposure scope and identify which compliance policies are violated
  3. Search for runtime or network threat detections against the same resource.name or resource.cloud_account_id in the past 7 days to determine whether the misconfiguration has already been exploited
Reference: https://docs.upwind.io/restapi/v1/get-threat-detection
Enabled: true
Filename: upwind_posture_detection_passthrough.py
Severity: Medium
Status: Experimental
LogTypes:
  - Upwind.Detections
DedupPeriodMinutes: 1440
Threshold: 1
Reports:
  MITRE ATT&CK:
    - TA0005:T1562  # Defense Evasion: Impair Defenses
    - TA0010:T1530  # Exfiltration: Data from Cloud Storage
Tags:
  - Upwind
  - Passthrough
  - Posture
  - CSPM
  - Defense Evasion
  - Exfiltration
  - Impair Defenses

from panther_upwind_helpers import (
    upwind_base_alert_context,
    upwind_commands_observed,
    upwind_format_mitre_attacks,
    upwind_is_known_severity,
    upwind_severity,
)

# Upwind runtime detections cover process execution, syscall anomalies,
# container escapes, and other host/container behavioral threats.
RUNTIME_KEYWORDS = ("runtime", "execution", "process", "container")

# Defer to higher-priority rules when their keywords also appear in the category
RUNTIME_EXCLUSIONS = ("api", "vulnerab", "network")


def rule(event):
    category = event.get("category", "").lower()
    return (
        upwind_is_known_severity(event)
        and any(kw in category for kw in RUNTIME_KEYWORDS)
        and not any(ex in category for ex in RUNTIME_EXCLUSIONS)
    )


def title(event):
    return f"[Upwind Runtime]: {event.get('title', '<NO TITLE>')}"


def severity(event):
    return upwind_severity(event)


def dedup(event):
    return f"{event.get('id', '<NO ID>')}_{event.get('severity', '<NO SEVERITY>')}"


def description(event):
    return event.get("description") or "DEFAULT"


def reference(event):
    return event.get("upwind_console_link") or "DEFAULT"


def alert_context(event):
    ctx = upwind_base_alert_context(event)
    ctx["commands_observed"] = upwind_commands_observed(event)
    ctx["mitre_attacks"] = upwind_format_mitre_attacks(event)
    return ctx

AnalysisType: rule
RuleID: Upwind.Detection.Runtime.Passthrough
DisplayName: Upwind Runtime Detection Passthrough
Description: >
  Re-raises Upwind runtime security detections in Panther. Covers process execution anomalies,
  syscall-based threats, container escapes, and other host/container behavioral threats.
Runbook: |
  1. Query Upwind.Detections for all detections against the same resource.name and resource.namespace in the 24 hours before this alert to determine if this is an isolated event or part of a pattern
  2. Review the commands observed in triggers[].events[].data.command and the process user in triggers[].events[].data.user_name to assess whether the activity is consistent with normal workload behavior for this resource
  3. Search for other HIGH or CRITICAL severity alerts from the same resource.cloud_account_id or resource.cluster_id in the past 7 days to identify lateral movement or broader compromise
Reference: https://docs.upwind.io/restapi/v1/get-threat-detection
Enabled: true
Filename: upwind_runtime_detection_passthrough.py
Severity: Medium
Status: Experimental
LogTypes:
  - Upwind.Detections
DedupPeriodMinutes: 720
Threshold: 1
Reports:
  MITRE ATT&CK:
    - TA0002:T1059  # Execution: Command and Scripting Interpreter
    - TA0004:T1611  # Privilege Escalation: Escape to Host
Tags:
  - Upwind
  - Passthrough
  - Runtime
  - Execution
  - Privilege Escalation
  - Command and Scripting Interpreter

from panther_upwind_helpers import (
    upwind_base_alert_context,
    upwind_is_known_severity,
    upwind_severity,
    upwind_triggered_policies,
)

# Upwind vulnerability detections surface exploitable CVEs in runtime
# containers, VMs, and serverless environments, prioritized by actual exposure.
VULNERABILITY_KEYWORDS = ("vulnerab",)  # matches "vulnerability" and "vulnerabilities"

# Defer to higher-priority rules when their keywords also appear in the category
VULNERABILITY_EXCLUSIONS = ("api",)


def rule(event):
    category = event.get("category", "").lower()
    return (
        upwind_is_known_severity(event)
        and any(kw in category for kw in VULNERABILITY_KEYWORDS)
        and not any(ex in category for ex in VULNERABILITY_EXCLUSIONS)
    )


def title(event):
    return f"[Upwind Vulnerability]: {event.get('title', '<NO TITLE>')}"


def severity(event):
    return upwind_severity(event)


def dedup(event):
    return f"{event.get('id', '<NO ID>')}_{event.get('severity', '<NO SEVERITY>')}"


def description(event):
    return event.get("description") or "DEFAULT"


def reference(event):
    return event.get("upwind_console_link") or "DEFAULT"


def alert_context(event):
    ctx = upwind_base_alert_context(event)
    ctx["triggered_policies"] = upwind_triggered_policies(event)
    return ctx

AnalysisType: rule
RuleID: Upwind.Detection.Vulnerability.Passthrough
DisplayName: Upwind Vulnerability Detection Passthrough
Description: >
  Re-raises Upwind vulnerability detections in Panther. Covers exploitable CVEs identified
  in runtime containers, VMs, and serverless environments, prioritized by active exposure.
Runbook: |
  1. Check whether resource.internet_exposure.ingress.active_communication is true and review resource.risk_categories to assess the blast radius of the vulnerability on resource.name in resource.cloud_account_id
  2. Query Upwind.Detections for all vulnerability detections on the same resource.name in the past 90 days to evaluate patch cadence and determine if this finding is recurring
  3. Search for runtime or network threat detections against the same resource.name or resource.cloud_account_id in the past 30 days to determine whether the vulnerability has already been exploited
Reference: https://docs.upwind.io/restapi/v1/get-threat-detection
Enabled: true
Filename: upwind_vulnerability_detection_passthrough.py
Severity: Medium
Status: Experimental
LogTypes:
  - Upwind.Detections
DedupPeriodMinutes: 1440
Threshold: 1
Reports:
  MITRE ATT&CK:
    - TA0001:T1190  # Initial Access: Exploit Public-Facing Application
Tags:
  - Upwind
  - Passthrough
  - Vulnerability
  - Initial Access
  - Exploit Public-Facing Application