Panther rules: wiz

from panther_base_helpers import deep_get


def rule(event):
    return event.get("status") == "OPEN" and event.get("severity") != "INFORMATIONAL"


def title(event):
    return (
        f"[Wiz Alert]: "
        f"{event.deep_get('sourceRule', 'name', default='ALERT_DESCRIPTION_NOT_FOUND')}"
    )


def severity(event):
    return event.get("severity")


def dedup(event):
    # For lower-severity events, dedup based on specific source rule to reduce overall alert volume
    if event.get("severity") in ("INFO", "LOW"):
        dedup_str = str(event.deep_get("sourceRule", "id"))
        if dedup_str:
            return dedup_str
    # If the severity is higher, or for some reason we couldn't generate a dedup string based on
    #   the source rule, then use the alert severity + the resource ID itself.
    return event.deep_get(
        "entitySnapshot", "externalId", default="<RESOURCE_NOT_FOUND>"
    ) + event.get("severity", "<SEVERITY_NOT_FOUND>")


def description(event):
    return event.deep_get("sourceRule", "controlDescription", default="<DESCRIPTION_NOT_FOUND>")


def reference(event):
    return get_issue_url(event) or "DEFAULT"


def runbook(event):
    return event.deep_get(
        "sourceRule", "resolutionRecommendation", default="<RECOMMENDATION_NOT_FOUND>"
    )


def alert_context(event):
    security_subcategories = event.deep_get("sourceRule", "securitySubCategories", default=[{}])
    return {
        "id": event.get("id", "<ID_NOT_FOUND>"),
        "type": event.get("type", "<TYPE_NOT_FOUND>"),
        "entity_snapshot": event.get("entitySnapshot", {}),
        "entity_url": get_entity_url(event),
        "mitre_attack_categories": [
            subcategory
            for subcategory in security_subcategories
            if deep_get(subcategory, "category", "framework", "name") == "MITRE ATT&CK Matrix"
        ],
    }


def get_issue_url(event):
    if issue_id := event.get("id"):
        return f"https://app.wiz.io/issues#~(issue~'{issue_id})"
    return None  # Return None if there's no issue ID


def get_entity_url(event):
    entity_id = event.deep_get("entitySnapshot", "id")
    entity_type = event.deep_get("entitySnapshot", "type")
    if entity_id and entity_type:
        return f"https://app.wiz.io/issues#~(entity~(~'{entity_id}*2c{entity_type}))"
    return None  # Return None if we're missing the ID or type

AnalysisType: rule
RuleID: Wiz.Alert.Passthrough
Description: This rule enriches and contextualizes security alerts generated by Wiz.
DisplayName: Wiz Alert Passthrough Rule
Runbook: Review the Wiz alert details to determine what malicious behavior was detected, and whether or not it was blocked.
Reference: https://www.wiz.io/product
Enabled: true
Filename: wiz_alert_passthrough.py
Severity: Medium
LogTypes:
  - Wiz.Issues
DedupPeriodMinutes: 720
Threshold: 1

from panther_wiz_helpers import wiz_actor, wiz_alert_context, wiz_success

SUSPICIOUS_ACTIONS = ["DeleteCICDScanPolicy", "UpdateCICDScanPolicy"]


def rule(event):
    if not wiz_success(event):
        return False
    return event.get("action", "ACTION_NOT_FOUND") in SUSPICIOUS_ACTIONS


def title(event):
    actor = wiz_actor(event)

    return (
        f"[Wiz]: [{event.get('action', 'ACTION_NOT_FOUND')}] action "
        f"performed by {actor.get('type')} [{actor.get('name')}]"
    )


def dedup(event):
    return event.get("id")


def alert_context(event):
    return wiz_alert_context(event)

AnalysisType: rule
RuleID: Wiz.CICD.Scan.Policy.Updated.Or.Deleted
Description: This rule detects updates and deletions of CICD scan policies.
DisplayName: Wiz CICD Scan Policy Updated Or Deleted
Runbook: Verify that this change was planned. If not, revert the change and ensure this doesn't happen again.
Reference: https://www.wiz.io/academy/ci-cd-security-best-practices
Enabled: true
Filename: wiz_cicd_scan_policy_updated_or_deleted.py
Severity: Medium
Reports:
  MITRE ATT&CK:
    - TA0005:T1562.001  # Impair Defenses: Disable or Modify Tools
LogTypes:
  - Wiz.Audit
DedupPeriodMinutes: 60
Threshold: 1

from panther_wiz_helpers import wiz_actor, wiz_alert_context, wiz_success

SUSPICIOUS_ACTIONS = ["DeleteConnector", "UpdateConnector"]


def rule(event):
    if not wiz_success(event):
        return False
    return event.get("action", "ACTION_NOT_FOUND") in SUSPICIOUS_ACTIONS


def title(event):
    actor = wiz_actor(event)

    return (
        f"[Wiz]: [{event.get('action', 'ACTION_NOT_FOUND')}] action "
        f"performed by {actor.get('type')} [{actor.get('name')}]"
    )


def dedup(event):
    return event.get("id")


def alert_context(event):
    return wiz_alert_context(event)

AnalysisType: rule
RuleID: Wiz.Connector.Updated.Or.Deleted
Description: This rule detects updates and deletions of connectors.
DisplayName: Wiz Connector Updated Or Deleted
Runbook: Verify that this change was planned. If not, revert the change and ensure this doesn't happen again.
Reference: https://help.vulcancyber.com/en/articles/6735270-wiz-connector  # article about integration with Vulcan
Enabled: true
Filename: wiz_connector_updated_or_deleted.py
Severity: Medium
Reports:
  MITRE ATT&CK:
    - TA0005:T1562.001  # Impair Defenses: Disable or Modify Tools
LogTypes:
  - Wiz.Audit
DedupPeriodMinutes: 60
Threshold: 1

from panther_wiz_helpers import wiz_actor, wiz_alert_context, wiz_success

SUSPICIOUS_ACTIONS = ["DeleteDataClassifier", "UpdateDataClassifier"]


def rule(event):
    if not wiz_success(event):
        return False
    return event.get("action", "ACTION_NOT_FOUND") in SUSPICIOUS_ACTIONS


def title(event):
    actor = wiz_actor(event)

    return (
        f"[Wiz]: [{event.get('action', 'ACTION_NOT_FOUND')}] action "
        f"performed by {actor.get('type')} [{actor.get('name')}]"
    )


def dedup(event):
    return event.get("id")


def alert_context(event):
    return wiz_alert_context(event)

AnalysisType: rule
RuleID: Wiz.Data.Classifier.Updated.Or.Deleted
Description: This rule detects updates and deletions of data classifiers.
DisplayName: Wiz Data Classifier Updated Or Deleted
Runbook: Verify that this change was planned. If not, revert the change and ensure this doesn't happen again.
Reference: https://www.wiz.io/solutions/dspm
Enabled: true
Filename: wiz_data_classifier_updated_or_deleted.py
Severity: Medium
Reports:
  MITRE ATT&CK:
    - TA0005:T1562.001  # Impair Defenses: Disable or Modify Tools
LogTypes:
  - Wiz.Audit
DedupPeriodMinutes: 60
Threshold: 1

def rule(event):
    return event.get("severity") != "INFORMATIONAL"


def title(event):
    return f"[Wiz Alert]: " f"{event.get('tdrId')}"


def severity(event):
    sev = (event.get("severity", "") or "").upper()
    if sev == "INFORMATIONAL":
        return "INFO"
    if sev in ("INFO", "LOW", "MEDIUM", "HIGH", "CRITICAL"):
        return sev
    return "DEFAULT"


def dedup(event):
    # For lower-severity events, dedup based on specific source rule to reduce overall alert volume
    if event.get("severity") in ("INFO", "INFORMATIONAL", "LOW"):
        dedup_str = str(event.get("tdrId"))
        if dedup_str:
            return dedup_str
    # If the severity is higher, or for some reason we couldn't generate a dedup string based on
    #   the source rule, then use the alert severity + the resource ID itself.
    return event.get("threatId") + "_" + event.get("severity", "<SEVERITY_NOT_FOUND>")


def description(event):
    return event.get("description")


def alert_context(event):
    return {
        "machine_id": event.deep_get("primaryResource", "externalId", default="<ID_NOT_FOUND>"),
        "machine_type": event.deep_get("primaryResource", "type", default="<TYPE_NOT_FOUND>"),
        "native_type": event.deep_get("primaryResource", "nativeType", default="<TYPE_NOT_FOUND>"),
        "machine_name": event.deep_get("primaryResource", "name", default="<NAME_NOT_FOUND>"),
        "mitre_attack_techniques": event.get("mitreTechniques"),
    }


def get_issue_url(event):
    if issue_id := event.get("id"):
        return f"https://app.wiz.io/issues#~(issue~'{issue_id})"
    return None  # Return None if there's no issue ID


def reference(event):
    return get_issue_url(event) or "DEFAULT"

AnalysisType: rule
RuleID: Wiz.Defend.Alert.Passthrough
Description: This rule enriches and contextualizes security alerts generated by Wiz.
DisplayName: Wiz Defend Alert Passthrough Rule
Runbook: Review the Wiz alert details to determine what malicious behavior was detected, and whether or not it was blocked.
Reference: https://www.wiz.io/product
Enabled: true
Filename: wiz_defend_passthrough.py
Severity: Medium
LogTypes:
  - Wiz.Detections
DedupPeriodMinutes: 720
Threshold: 1

from panther_wiz_helpers import wiz_actor, wiz_alert_context, wiz_success

SUSPICIOUS_ACTIONS = ["DeleteImageIntegrityValidator", "UpdateImageIntegrityValidator"]


def rule(event):
    if not wiz_success(event):
        return False
    return event.get("action", "ACTION_NOT_FOUND") in SUSPICIOUS_ACTIONS


def title(event):
    actor = wiz_actor(event)

    return (
        f"[Wiz]: [{event.get('action', 'ACTION_NOT_FOUND')}] action "
        f"performed by {actor.get('type')} [{actor.get('name')}]"
    )


def dedup(event):
    return event.get("id")


def alert_context(event):
    return wiz_alert_context(event)

AnalysisType: rule
RuleID: Wiz.Image.Integrity.Validator.Updated.Or.Deleted
Description: This rule detects updates and deletions of image integrity validators.
DisplayName: Wiz Image Integrity Validator Updated Or Deleted
Runbook: Verify that this change was planned. If not, revert the change and ensure this doesn't happen again.
Reference: https://www.wiz.io/blog/ensuring-supply-chain-security-verify-container-image-integrity-with-the-wiz-admi
Enabled: true
Filename: wiz_image_integrity_validator_updated_or_deleted.py
Severity: Medium
Reports:
  MITRE ATT&CK:
    - TA0005:T1562.001  # Impair Defenses: Disable or Modify Tools
LogTypes:
  - Wiz.Audit
DedupPeriodMinutes: 60
Threshold: 1

from panther_wiz_helpers import wiz_actor, wiz_alert_context, wiz_success

SUSPICIOUS_ACTIONS = ["DeleteIntegration", "UpdateIntegration"]


def rule(event):
    if not wiz_success(event):
        return False
    return event.get("action", "ACTION_NOT_FOUND") in SUSPICIOUS_ACTIONS


def title(event):
    actor = wiz_actor(event)

    return (
        f"[Wiz]: [{event.get('action', 'ACTION_NOT_FOUND')}] action "
        f"performed by {actor.get('type')} [{actor.get('name')}]"
    )


def dedup(event):
    return event.get("id")


def alert_context(event):
    return wiz_alert_context(event)

AnalysisType: rule
RuleID: Wiz.Integration.Updated.Or.Deleted
Description: This rule detects updates and deletions of Wiz integrations.
DisplayName: Wiz Integration Updated Or Deleted
Runbook: Verify that this change was planned. If not, revert the change and ensure this doesn't happen again.
Reference: https://www.wiz.io/integrations
Enabled: true
Filename: wiz_integration_updated_or_deleted.py
Severity: Medium
Reports:
  MITRE ATT&CK:
    - TA0005:T1562.001  # Impair Defenses: Disable or Modify Tools
LogTypes:
  - Wiz.Audit
DedupPeriodMinutes: 60
Threshold: 1

def rule(event):
    return (
        event.deep_get("issue", "status") == "OPEN"
        and event.deep_get("issue", "severity") != "INFORMATIONAL"
    )


def title(event):
    return f"[Wiz Alert]: " f"{event.deep_get('control', 'name', default='ALERT_NAME_NOT_FOUND')}"


def severity(event):
    return event.deep_get("issue", "severity")


def dedup(event):
    if event.deep_get("issue", "severity") in ("INFO", "LOW"):
        # If Wiz's severity is INFO or LOW, dedup on rule ID
        dedup_str = event.deep_get("control", "id", default="<NO_ID_FOUND>")
        if dedup_str:
            return dedup_str
    # If higher severity, dedup on the issue ID
    return (
        event.deep_get("issue", "id", default="<ISSUE_ID_NOT_FOUND>")
        + "_"
        + event.deep_get("issue", "severity", default="<SEVERITY_NOT_FOUND>")
    )


def description(event):
    return event.deep_get("control", "description", default="<DESCRIPTION_NOT_FOUND>")


def reference(event):
    return get_issue_url(event) or "DEFAULT"


def alert_context(event):
    return {
        "id": event.deep_get("resource", "id") or "<ID_NOT_FOUND>",
        "type": event.deep_get("resource", "type") or "<TYPE_NOT_FOUND>",
        "name": event.deep_get("resource", "name") or "<NAME_NOT_FOUND>",
    }


def get_issue_url(event):
    if issue_id := event.deep_get("issue", "id"):
        return f"https://app.wiz.io/issues#~(issue~'{issue_id})"
    return None  # Return None if there's no issue ID

AnalysisType: rule
RuleID: Wiz.Issue.Alert.Passthrough
Description: This rule enriches and contextualizes security alerts generated by Wiz.
DisplayName: Wiz Issue Alert Passthrough Rule
Runbook: Review the Wiz alert details to determine what malicious behavior was detected, and whether or not it was blocked.
Reference: https://www.wiz.io/product
Enabled: true
Filename: wiz_issue_alert_passthrough.py
Severity: Medium
LogTypes:
  - Wiz.IssuesWebhook
DedupPeriodMinutes: 720
Threshold: 1

AnalysisType: correlation_rule
RuleID: "Wiz.Issue.WITH.SSH"
DisplayName: "Wiz Issue WITH SSH to EC2 Instance"
Enabled: false
Severity: High
Tags:
    - Configuration Required
Description: Wiz detected a security issue with an EC2 instance followed by an SSH connection to the instance. This sequence could indicate a potential security breach.
Reports:
  MITRE ATT&CK:
    - TA0008:T1021.004 # Lateral Movement: Remote Services: SSH
    - TA0001:T1133 # Initial Access: External Remote Services
Detection:
    - Group:
        - ID: WizIssue
          RuleID: Wiz.Alert.Passthrough
        - ID: SSH Access
          RuleID: AWS.VPC.SSHAllowedSignal
      MatchCriteria:
        field_name:
          - GroupID: WizIssue
            Match: entitySnapshot.externalId
          - GroupID: SSH Access
            Match: instanceId
      LookbackWindowMinutes: 1800
      Schedule:
        RateMinutes: 1440
        TimeoutMinutes: 5

from panther_wiz_helpers import wiz_actor, wiz_alert_context, wiz_success


def rule(event):
    if not wiz_success(event):
        return False
    return event.get("action", "ACTION_NOT_FOUND") == "RevokeUserSessions"


def title(event):
    actor = wiz_actor(event)

    return (
        f"[Wiz]: [{event.get('action', 'ACTION_NOT_FOUND')}] action "
        f"performed by {actor.get('type')} [{actor.get('name')}]"
    )


def dedup(event):
    return event.get("id")


def alert_context(event):
    return wiz_alert_context(event)

AnalysisType: rule
RuleID: Wiz.Revoke.User.Sessions
Description: This rule detects user sessions revoked.
DisplayName: Wiz Revoke User Sessions
Runbook: Verify that this change was planned. If not, revoke all the sessions of the account and change its credentials
Reference: https://www.wiz.io/blog/storm-0558-compromised-microsoft-key-enables-authentication-of-countless-micr
Enabled: true
Filename: wiz_revoke_user_sessions.py
Severity: Medium
Reports:
  MITRE ATT&CK:
    - TA0040:T1531  # Account Access Removal
LogTypes:
  - Wiz.Audit
DedupPeriodMinutes: 60
Threshold: 1

from panther_wiz_helpers import wiz_actor, wiz_alert_context, wiz_success


def rule(event):
    if not wiz_success(event):
        return False
    return event.get("action", "ACTION_NOT_FOUND") == "RotateServiceAccountSecret"


def title(event):
    actor = wiz_actor(event)

    return (
        f"[Wiz]: [{event.get('action', 'ACTION_NOT_FOUND')}] action "
        f"performed by {actor.get('type')} [{actor.get('name')}]"
    )


def dedup(event):
    return event.get("id")


def alert_context(event):
    return wiz_alert_context(event)

AnalysisType: rule
RuleID: Wiz.Rotate.Service.Account.Secret
Description: This rule detects service account secrets rotations.
DisplayName: Wiz Rotate Service Account Secret
Runbook: Verify the action was planned.
Reference: https://www.wiz.io/academy/kubernetes-secrets
Enabled: true
Filename: wiz_rotate_service_account_secret.py
Severity: Medium
Reports:
  MITRE ATT&CK:
    - TA0001:T1078.004  # Valid Accounts: Cloud Accounts
LogTypes:
  - Wiz.Audit
DedupPeriodMinutes: 60
Threshold: 1

from panther_wiz_helpers import wiz_actor, wiz_alert_context, wiz_success

SUSPICIOUS_ACTIONS = [
    "DeleteAutomationRule",
    "UpdateAutomationRule",
    "DeleteCloudEventRule",
    "UpdateCloudEventRule",
    "DeleteCloudConfigurationRule",
    "UpdateCloudConfigurationRule",
    "DeleteHostConfigurationRule",
    "UpdateHostConfigurationRule",
    "CreateIgnoreRule",
    "DeleteIgnoreRule",  # we have no sample log for such event, but I suppose there should be one
    "UpdateIgnoreRule",
    "CreateMalwareExclusion",
    "UpdateMalwareExclusion",
]


def rule(event):
    if not wiz_success(event):
        return False
    return event.get("action", "ACTION_NOT_FOUND") in SUSPICIOUS_ACTIONS


def title(event):
    actor = wiz_actor(event)

    return (
        f"[Wiz]: [{event.get('action', 'ACTION_NOT_FOUND')}] action "
        f"performed by {actor.get('type')} [{actor.get('name')}]"
    )


def dedup(event):
    return event.get("id")


def alert_context(event):
    return wiz_alert_context(event)


def severity(event):
    action = event.get("action", "ACTION_NOT_FOUND")
    if "Delete" in action:
        return "High"
    if "Create" in action:
        return "Low"
    return "Default"

AnalysisType: rule
RuleID: Wiz.Rule.Change
Description: This rule detects creations, updates and deletions of Wiz rules.
DisplayName: Wiz Rule Change
Runbook: Verify that this change was planned. If not, revert the change and ensure this doesn't happen again. If needed, review the privileges of existing accounts.
Reference: https://www.wiz.io/blog/custom-runtime-rules-and-response-policies
Enabled: true
Filename: wiz_rule_change.py
Severity: Medium
Reports:
  MITRE ATT&CK:
    - TA0005:T1562.001  # Impair Defenses: Disable or Modify Tools
LogTypes:
  - Wiz.Audit
DedupPeriodMinutes: 60
Threshold: 1

from panther_wiz_helpers import wiz_actor, wiz_alert_context, wiz_success

SUSPICIOUS_ACTIONS = [
    "UpdateSAMLIdentityProvider",
    "DeleteSAMLIdentityProvider",
    "CreateSAMLIdentityProvider",
    "ModifySAMLIdentityProviderGroupMappings",
]


def rule(event):
    if not wiz_success(event):
        return False
    return event.get("action", "ACTION_NOT_FOUND") in SUSPICIOUS_ACTIONS


def title(event):
    actor = wiz_actor(event)

    return (
        f"[Wiz]: [{event.get('action', 'ACTION_NOT_FOUND')}] action "
        f"performed by {actor.get('type')} [{actor.get('name')}]"
    )


def dedup(event):
    return event.get("id")


def alert_context(event):
    return wiz_alert_context(event)

AnalysisType: rule
RuleID: Wiz.SAML.Identity.Provider.Change
Description: This rule detects creations, updates and deletions of SAML identity providers.
DisplayName: Wiz SAML Identity Provider Change
Runbook: Verify that this change was planned. If not, revert the change and ensure this doesn't happen again.
Reference: https://support.wiz.io/hc/en-us/articles/5644029716380-Single-Sign-on-SSO-Overview
Enabled: true
Filename: wiz_saml_identity_provider_change.py
Severity: High
Reports:
  MITRE ATT&CK:
    - TA0004:T1484.002 # Domain or Tenant Policy Modification: Trust Modification 
LogTypes:
  - Wiz.Audit
DedupPeriodMinutes: 60
Threshold: 1

from panther_wiz_helpers import wiz_actor, wiz_alert_context, wiz_success

SUSPICIOUS_ACTIONS = [
    "CreateServiceAccount",
    "DeleteServiceAccount",
    "UpdateServiceAccount",
]


def rule(event):
    if not wiz_success(event):
        return False
    return event.get("action", "ACTION_NOT_FOUND") in SUSPICIOUS_ACTIONS


def title(event):
    actor = wiz_actor(event)

    return (
        f"[Wiz]: [{event.get('action', 'ACTION_NOT_FOUND')}] action "
        f"performed by {actor.get('type')} [{actor.get('name')}]"
    )


def dedup(event):
    return event.get("id")


def alert_context(event):
    return wiz_alert_context(event)

AnalysisType: rule
RuleID: Wiz.Service.Account.Change
Description: This rule detects creations, updates and deletions of service accounts.
DisplayName: Wiz Service Account Change
Runbook: Confirm this user acted with valid business intent and determine whether this activity was authorized.
Reference: https://www.wiz.io/blog/non-human-identities-dashboard
Enabled: true
Filename: wiz_service_account_change.py
Severity: High
Reports:
  MITRE ATT&CK:
    - TA0001:T1078.004  # Valid Accounts: Cloud Accounts
LogTypes:
  - Wiz.Audit
DedupPeriodMinutes: 60
Threshold: 1

from panther_wiz_helpers import wiz_actor, wiz_alert_context, wiz_success


def rule(event):
    if not wiz_success(event):
        return False
    return event.get("action", "ACTION_NOT_FOUND") == "UpdateIPRestrictions"


def title(event):
    actor = wiz_actor(event)

    return (
        f"[Wiz]: [{event.get('action', 'ACTION_NOT_FOUND')}] action "
        f"performed by {actor.get('type')} [{actor.get('name')}]"
    )


def dedup(event):
    return event.get("id")


def alert_context(event):
    return wiz_alert_context(event)

AnalysisType: rule
RuleID: Wiz.Update.IP.Restrictions
Description: This rule detects updates of IP restrictions.
DisplayName: Wiz Update IP Restrictions
Runbook: Verify that this change was planned. If not, revert the change and ensure this doesn't happen again.
Reference: https://docs.wiz.io/docs/portal-security-settings#ip-restrictions
Enabled: true
Filename: wiz_update_ip_restrictions.py
Severity: High
Reports:
  MITRE ATT&CK:
    - TA0003:T1556.009 # Modify Authentication Process: Conditional Access Policies
LogTypes:
  - Wiz.Audit
DedupPeriodMinutes: 60
Threshold: 1

from panther_wiz_helpers import wiz_actor, wiz_alert_context, wiz_success


def rule(event):
    if not wiz_success(event):
        return False
    return event.get("action", "ACTION_NOT_FOUND") == "UpdateLoginSettings"


def title(event):
    actor = wiz_actor(event)

    return (
        f"[Wiz]: [{event.get('action', 'ACTION_NOT_FOUND')}] action "
        f"performed by {actor.get('type')} [{actor.get('name')}]"
    )


def dedup(event):
    return event.get("id")


def alert_context(event):
    return wiz_alert_context(event)

AnalysisType: rule
RuleID: Wiz.Update.Login.Settings
Description: This rule detects updates of Wiz login settings.
DisplayName: Wiz Update Login Settings
Runbook: Verify that this change was planned. If not, revert the change and ensure this doesn't happen again.
Reference: https://support.wiz.io/hc/en-us/categories/5311977085340-User-Management
Enabled: true
Filename: wiz_update_login_settings.py
Severity: Medium
Reports:
  MITRE ATT&CK:
    - TA0006:T1556  # Modify Authentication Process
LogTypes:
  - Wiz.Audit
DedupPeriodMinutes: 60
Threshold: 1

from panther_wiz_helpers import wiz_actor, wiz_alert_context, wiz_success


def rule(event):
    if not wiz_success(event):
        return False
    return event.get("action", "ACTION_NOT_FOUND") == "UpdateScannerSettings"


def title(event):
    actor = wiz_actor(event)

    return (
        f"[Wiz]: [{event.get('action', 'ACTION_NOT_FOUND')}] action "
        f"performed by {actor.get('type')} [{actor.get('name')}]"
    )


def dedup(event):
    return event.get("id")


def alert_context(event):
    return wiz_alert_context(event)

AnalysisType: rule
RuleID: Wiz.Update.Scanner.Settings
Description: This rule detects updates of Wiz scanner settings.
DisplayName: Wiz Update Scanner Settings
Runbook: Verify that this change was planned. If not, revert the change and ensure this doesn't happen again.
Reference: https://www.wiz.io/academy/secret-scanning
Enabled: true
Filename: wiz_update_scanner_settings.py
Severity: Medium
Reports:
  MITRE ATT&CK:
    - TA0005:T1562.001  # Impair Defenses: Disable or Modify Tools
LogTypes:
  - Wiz.Audit
DedupPeriodMinutes: 60
Threshold: 1

from panther_wiz_helpers import wiz_actor, wiz_alert_context, wiz_success


def rule(event):
    if not wiz_success(event):
        return False
    return event.get("action", "ACTION_NOT_FOUND") == "UpdateSupportContactList"


def title(event):
    actor = wiz_actor(event)

    return (
        f"[Wiz]: [{event.get('action', 'ACTION_NOT_FOUND')}] action "
        f"performed by {actor.get('type')} [{actor.get('name')}]"
    )


def dedup(event):
    return event.get("id")


def alert_context(event):
    return wiz_alert_context(event)

AnalysisType: rule
RuleID: Wiz.Update.Support.Contact.List
Description: This rule detects updates of Wiz support contact list.
DisplayName: Wiz Update Support Contact List
Runbook: Verify that this change was planned. If not, revert the change and ensure this doesn't happen again.
Reference: https://www.wiz.io/
Enabled: true
Filename: wiz_update_support_contact_list.py
Severity: Low
Reports:
  MITRE ATT&CK:
    - TA0035:T1636.003  # Protected User Data: Contact List
LogTypes:
  - Wiz.Audit
DedupPeriodMinutes: 60
Threshold: 1

from panther_wiz_helpers import wiz_actor, wiz_alert_context, wiz_success

SUSPICIOUS_ACTIONS = ["CreateUser", "DeleteUser"]


def rule(event):
    if not wiz_success(event):
        return False
    return event.get("action", "ACTION_NOT_FOUND") in SUSPICIOUS_ACTIONS


def title(event):
    actor = wiz_actor(event)

    return (
        f"[Wiz]: [{event.get('action', 'ACTION_NOT_FOUND')}] action "
        f"performed by {actor.get('type')} [{actor.get('name')}]"
    )


def dedup(event):
    return event.get("id")


def alert_context(event):
    return wiz_alert_context(event)

AnalysisType: rule
RuleID: Wiz.User.Created.Or.Deleted
Description: This rule detects creations and deletions of Wiz users.
DisplayName: Wiz User Created Or Deleted
Runbook: Verify that this change was planned.
Reference: https://support.wiz.io/hc/en-us/categories/5311977085340-User-Management
Enabled: true
Filename: wiz_user_created_or_deleted.py
Severity: Low
Reports:
  MITRE ATT&CK:
    - TA0003:T1136.003 # Create Account
    - TA0005:T1070.009 # Indicator Removal
LogTypes:
  - Wiz.Audit
DedupPeriodMinutes: 60
Threshold: 1

from panther_wiz_helpers import wiz_actor, wiz_alert_context, wiz_success

SUSPICIOUS_ACTIONS = ["DeleteUserRole", "UpdateUserRole"]


def rule(event):
    if not wiz_success(event):
        return False
    return event.get("action", "ACTION_NOT_FOUND") in SUSPICIOUS_ACTIONS


def title(event):
    actor = wiz_actor(event)

    return (
        f"[Wiz]: [{event.get('action', 'ACTION_NOT_FOUND')}] action "
        f"performed by {actor.get('type')} [{actor.get('name')}]"
    )


def dedup(event):
    return event.get("id")


def alert_context(event):
    return wiz_alert_context(event)


def severity(event):
    action = event.get("action", "ACTION_NOT_FOUND")
    if "Delete" in action:
        return "High"
    return "Default"

AnalysisType: rule
RuleID: Wiz.User.Role.Updated.Or.Deleted
Description: This rule detects updates and deletions of Wiz user roles.
DisplayName: Wiz User Role Updated Or Deleted
Runbook: Verify that this change was planned. If not, revert the change and ensure this doesn't happen again. Review privileges given to accounts to ensure the principle of minimal privilege
Reference: https://www.wiz.io/blog/cloud-security-custom-roles-democratization
Enabled: true
Filename: wiz_user_role_updated_or_deleted.py
Severity: Medium
Reports:
  MITRE ATT&CK:
    - TA0003:T1098.001  # Account Manipulation
LogTypes:
  - Wiz.Audit
DedupPeriodMinutes: 60
Threshold: 1