Detection rules › Panther
Zendesk API Token Created
A user created a new API token to be used with Zendesk.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Credential Access | T1528 Steal Application Access Token |
Rule body yaml
AnalysisType: rule
Filename: zendesk_new_api_token.py
RuleID: "Zendesk.NewAPIToken"
DedupPeriodMinutes: 60
DisplayName: "Zendesk API Token Created"
Enabled: true
LogTypes:
- Zendesk.Audit
Severity: High
Tags:
- Zendesk
- Credential Access:Steal Application Access Token
Reports:
MITRE ATT&CK:
- TA0006:T1528
Description: A user created a new API token to be used with Zendesk.
Runbook: Validate the api token was created for valid use case, otherwise delete the token immediately.
Reference: https://support.zendesk.com/hc/en-us/articles/4408889192858-Managing-access-to-the-Zendesk-API#topic_bsw_lfg_mmb:~:text=enable%20token%20access.-,Generating%20API%20tokens,-To%20generate%20an
SummaryAttributes:
- p_any_ip_addresses
Tests:
- Name: Zendesk - API Token Updated
ExpectedResult: false
Log:
{
"url": "https://myzendek.zendesk.com/api/v2/audit_logs/111222333444.json",
"id": 123456789123,
"action_label": "Updated",
"actor_id": 123,
"actor_name": "John Doe",
"source_id": 123,
"source_type": "api_token",
"source_label": "API token: a new description",
"action": "update",
"change_description": "description changed from not set to a new description",
"ip_address": "127.0.0.1",
"created_at": "2021-05-28T18:39:50Z",
"p_log_type": "Zendesk.Audit",
}
- Name: Zendesk - API Token Created
ExpectedResult: true
Log:
{
"url": "https://myzendek.zendesk.com/api/v2/audit_logs/111222333444.json",
"id": 123456789123,
"action_label": "Created",
"actor_id": 123,
"actor_name": "John Doe",
"source_id": 123,
"source_type": "api_token",
"source_label": "API token",
"action": "create",
"change_description": "",
"ip_address": "127.0.0.1",
"created_at": "2021-05-28T18:39:50Z",
"p_log_type": "Zendesk.Audit",
}
Detection logic
Condition
source_type eq "api_token"
action in ["create", "destroy"]
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
action | in |
|
source_type | eq |
|
Output fields
Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.
| Field |
|---|
p_log_type |
actor_user |
action |