Detection rules › Panther

Panther rules: user

Rule	Severity
Atlassian admin impersonated another user	`high`

Atlassian admin impersonated another user

Severity: high
Log types: Atlassian.Audit
Tags: Atlassian, User impersonation
Reference: support.atlassian.com
Source: github.com/panther-labs/panther-analysis

Reports when an Atlassian user logs in (impersonates) another user.

Detection logic

def rule(event):
    return (
        event.deep_get("attributes", "action", default="<unknown-action>")
        == "user_logged_in_as_user"
    )


def title(event):
    actor = event.deep_get("attributes", "actor", "email", default="<unknown-email>")
    context = event.deep_get("attributes", "context", default=[{}])
    impersonated_user = context[0].get("attributes", {}).get("email", "<unknown-email>")
    return f"{actor} logged in as {impersonated_user}."


def alert_context(event):
    return {
        "Timestamp": event.deep_get("attributes", "time", default="<unknown-time>"),
        "Actor": event.deep_get("attributes", "actor", "email", default="<unknown-actor-email>"),
        "Impersonated user": event.deep_get("attributes", "context", default=[{}])[0]
        .get("attributes", {})
        .get("email", "<unknown-email>"),
        "Event ID": event.get("id"),
    }

Rule specification

AnalysisType: rule
DedupPeriodMinutes: 60 # 1 hour
DisplayName: "Atlassian admin impersonated another user"
Enabled: true
Filename: user_logged_in_as_user.py
RuleID: "Atlassian.User.LoggedInAsUser"
Severity: High
LogTypes:
  - Atlassian.Audit
Tags:
  - Atlassian
  - User impersonation
Description: >
  Reports when an Atlassian user logs in (impersonates) another user.
Runbook: >
  Validate that the Atlassian admin did log in (impersonate) as another user.
Reference: https://support.atlassian.com/user-management/docs/log-in-as-another-user/

Stages and Predicates

Fires on Atlassian.Audit events when the condition below holds.

Condition

attributes.action is user_logged_in_as_user

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`attributes.action`	eq	`user_logged_in_as_user`	`field:"attributes.action" kind:eq value:"user_logged_in_as_user"`

Output fields

Fields the rule emits when it matches, drawn from the rule's alert_context.

Field	Source
`Timestamp`	`attributes.time`
`Actor`	`attributes.actor.email`
`Event ID`	`id`

Response runbook

Validate that the Atlassian admin did log in (impersonate) as another user.

Worked example

A sample event from the rule's unit tests that triggers a match.

Sample Test Event

{
  "attributes": {
    "action": "user_logged_in_as_user",
    "actor": {
      "email": "example.admin@example.com",
      "id": "1234567890abcdefghijklmn",
      "name": "Example Admin"
    },
    "container": [
      {
        "attributes": {
          "siteHostName": "https://example.atlassian.net",
          "siteName": "example"
        },
        "id": "12345678-abcd-9012-efgh-1234567890abcd",
        "links": {
          "alt": "https://example.atlassian.net"
        },
        "type": "sites"
      }
    ],
    "context": [
      {
        "attributes": {
          "accountType": "atlassian",
          "email": "example.user@example.io",
          "name": "example.user@example.io"
        },
        "type": "users"
      }
    ],
    "time": "2022-12-15T00:35:15.890Z"
  },
  "id": "2508d209-3336-4763-89a0-aceaf1322fcf",
  "message": {
    "content": "Logged in as example.user@example.io",
    "format": "simple"
  }
}